Sophos is breaking SSL verification for cloudfront.net URLs

Question

I have disabled all the malware scanning options - https://cl.ly/nEoF Still, when Sophos firewall is active it invalidates the SSL certificates on most of the domains. 
 Sophos taking over SSL -

Correct working SSL if Sophos is completed turned off. 
 
 any ideas how this can be avoided?

lferrara · Answer

Nikhil , 
 make to disable micro-app scanning from console. Also on the firewall rule (LAN to WAN) uncheck decrypt and scan. 
 Regards

lferrara · Answer

Ok. Is the "system application_classification on" from console? 
 Also try to add the domain inside Web > Exceptions. If it does not work, reboot the XG (if you can) and make sure to clear computer's browser cache. 
 Lastly, move to v17. 
 Regards

sachingurung · Answer

Hi Nikhil, 
 Try what Luk suggested if that doesn't help and if the malware scanning is disabled in the firewall rule then importing the CA is not required. Clear the browser cache and try to access the website, it could be caused due to existing cache files. Check #1.1 in my troubleshooting guide and check which firewall rule id forwards the traffic for the source IP address. Show us the screenshots of that rule. 
 Always import the Sophos CA into the Trusted Root Directories using Microsoft Management Console . Refer, Install the Certificate in the local machine&rsquo;s Trusted Root Authority container . 
 Thanks