Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 4 subscribers
  • Views 1006 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL Filter, neues Zertifika 2 Jahre Gültigkeit

xantu master

Hi,

ich bin gerade dabei, meine UTM Home einzurichten, auch das https-scanning funktioniert, ledeglich bei ios 13.x Geräten nicht, da das Zertifikat nicht mehr korrekt ist.

Laut diversen Google Recherchen ist die Gültigkeit über 2 Jahre das Problem, nur habe ich meinen mac, um das Problem zu lösen.

Wie kann ich denn (unter windows 10 oder ubuntu) ein Zertifikat mit "nur" 2 Jahren Gültigkeit erstellen bitte?

 

Grüße

René

 

untenstehend ein Zitat, welches die Problemlösung beschreibt

<<

 I ran the CA signing cert process from my Mac Catalina and it defaulted to creating a 2048 key.  Just do a search on "how to generate a 2048 signing cert" for your specific OS and then import into the UTM under "Web Protection/Filtering Options/HTTPS CAs/Signing CA".  Don't hit the "Regenerate" under "Signing CA" as it will default to a 1024 key.  Make sure to upload the new one you just created.

>>



This thread was automatically locked due to age.
  • 0

    und das Zitat von apple:

     

    All TLS server certificates must comply with these new security requirements in iOS 13 and macOS 10.15:

    • TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.
    • TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.
    • TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.

    Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines:

    • TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.
    • TLS server certificates must have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate).

    Connections to TLS servers violating these new requirements will fail and may cause network failures, apps to fail, and websites to not load in Safari in iOS 13 and macOS 10.15.

  • 0 in reply to xantu master

    So, na ich ab es dann selber gelöst. Über eine Windows Server CA habe ich ein 2 Jahre gültiges Zertifikat auf der Basis der "untergeordnete Zertifizierungsstelle" ausgestellt und importiert.

  • 0 in reply to xantu master

    Ein Update auf UTM 9.700 sollte das Problem beheben. Dort kann man ein Zertifikat mit den Anforderungen erstellen. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    moin

    leider nein, ich nutze nun schon Release 9.700-5

Unfiltered HTML