[8.281][NOTABUG][CLOSED] Self-signed cert popup with HTTPS proxy?

Maybe I've been gone too long, but I distinctly recall that I used to get a popup when browsing to a site with a self-signed cert, and that no longer happens.

HTTP/S proxy is doing SSL/TLS inspection, in transparent mode, no authentication. Currently on 8.281, but it seems to have been happening for a while.

"Failure to validate cert" error is in the proxy log, but no message is displayed to the user.

Have I broken something, or is this a "feature" because the popups just confused end-users?

[EDIT: It wasn't a popup, it was an option on the "block" page. I now get it in standard mode proxy, but not in transparent. And don't get me started on how Firefox handles certs lately...]

Thanks
Jack

0 BAlfson over 13 years ago

Hey, Jack, welcome back!

I'm moving you over to the beta forum - I bet you found an undocumented feature! [:D]

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 13 years ago

Astaro Beta Report
--------------------------------
Version: 8.281
Type: NOTABUG
State: CLOSED
Reporter: Jack Daniel
Contributor: 
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 Jack Daniel over 13 years ago in reply to Astaro Beta Bot

Thanks Bob!

QA probably still has a login for my system if they need it [;)]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Jack Daniel over 13 years ago in reply to Jack Daniel

Treating this like a real bug report:

When transparent HTTPS proxy is active Chrome reports:
"Error 101 (net::ERR_CONNECTION_RESET): The connection was reset."

Corresponding log entry:
2011:11:21-18:29:28 jdasg httpproxy[5859]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="***.***.***.***" dstip="" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" request="0x92f0720" url="https://***.***.***.***" exceptions="" error="Failed to verify server certificate"
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 13 years ago

Hi Jack,

In ASG 7 the certificate handling was completely broken (i.e. certificates were not validated at all). In ASG 8 we fixed that, so now the HTTP proxy tries to validate the server certificates, which also introduced the new behavior you described.

The problem is that we cannot create a proxy certificate based on an untrusted server certificate. But without that proxy certificate we can't even deliver the block page over the encrypted connection that the browser wants to negotiate. This is why we simply reset the client's TCP connection.

Regards,
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Jack Daniel over 13 years ago in reply to mle

Ah, OK. Makes sense, just annoying that the user can't get a reason.

Easy answer for me is to set an alert in my SecurityCenter (SIEM) when I pick up that log entry, but that's a bit convoluted.

Thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel