Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 27 subscribers
  • Views 12402 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

certificate error

Tiago Toledo

Question 1)
I am doing some tests and when accessing the XG (https://172.16.16.16:4444) the certificate message appears. As attachment.

I saw this SOPHOS procedure, but it did not work. How do I apply the SOPHOS certificate in the user's browser so that this message no longer appears?

community.sophos.com/.../123048

 

https://community.sophos.com/kb/en-us/123048

Question 2)

With regard to the captive portal, is the same thing valid?



This thread was automatically locked due to age.
Parents
  • 0

    Tiago,

    here you have 2 issues:

    1. the Certificate is issued to a different IP/FQDN
    2. you did not import the CA inside your Computer Certificates

    For the first issue, you can generate a different Certificate and making sure that the Common Name reflects your IP address.

    For the second, make sure to use the Certificates Snap-in.

    For the Captive portal, at the moment there is no way to use the FQDN  but only the IP.

    https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/11580213-captive-portal-fqdn-support

    Regards

  • 0 in reply to lferrara

    Sorry for my ignorance on this subject.
    On this first solution: the Certificate is issued to a different IP / FQDN
    Would you have some step by step how to do this procedure?

    About this question: You did not import the CA inside your Computer Certificates
    Access Certificate> Certificate authorizations> SecurityAppliance_SSL_CA clicked on download and installed on the desktop, but did not work. Was there any procedure for me to check what I did wrong?

  • 0 in reply to Tiago Toledo

    Tiago,

    in order to import the CA into your windows Computer, use this old guide:

    http://www.dartmouth.edu/~deploypki/materials/web_authn/pages/IISonXP_AddingTrustedCACertToComputer.htm

    For the first issue, the Common name must reflect the IP or FQDN used. So you need to create on XG a self-signed certificate under Certificate where the CN is the internal IP and change it under Administration > Admin settings.

    Regards

  • 0 in reply to lferrara

    Hi  

    Thanks for answering. This first procedure I did inclusive, I installed the certificate in my windows 10, but the certificate error continues to appear.

    About generating the certificate itself, I was able to generate the certificate, but soon after generating this certificate, what next? Do I need to have an internal CA?

    Thanks in advance for your help!

  • +1 in reply to Tiago Toledo

    Tiago,

    if the error still appear something is wrong. You have to read carefully what the Browser is telling you about the error. Take note that you need to import the CA:

    https://community.sophos.com/kb/en-us/123048

    Because the Default CA is not trusted by your browser. It is not in the list of the approved CA. Every browser comes with a list of "good" CA, which are the popular CA around the world.

    Because CA uses hierarchies, if you trust the CA all the Certificates generated by the trusted CA will be also trusted.

    https://technet.microsoft.com/en-us/library/cc962065.aspx

    Once the CA has been trusted, make sure that the certificate you generated, the Common Name reflects the name/ip you are generating for.

    For example, if you need to generate a certificate for webmail.test.com, you will need to generate a certificate where the CN is webmail.test.com

    If the webmail service also is reached using IP, you need to generate another certificate, because the CN is webmail.test.com but you are trying to access the service by IP, so the CN does not match.

Reply
  • +1 in reply to Tiago Toledo

    Tiago,

    if the error still appear something is wrong. You have to read carefully what the Browser is telling you about the error. Take note that you need to import the CA:

    https://community.sophos.com/kb/en-us/123048

    Because the Default CA is not trusted by your browser. It is not in the list of the approved CA. Every browser comes with a list of "good" CA, which are the popular CA around the world.

    Because CA uses hierarchies, if you trust the CA all the Certificates generated by the trusted CA will be also trusted.

    https://technet.microsoft.com/en-us/library/cc962065.aspx

    Once the CA has been trusted, make sure that the certificate you generated, the Common Name reflects the name/ip you are generating for.

    For example, if you need to generate a certificate for webmail.test.com, you will need to generate a certificate where the CN is webmail.test.com

    If the webmail service also is reached using IP, you need to generate another certificate, because the CN is webmail.test.com but you are trying to access the service by IP, so the CN does not match.

Children