Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 549 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL issues after 7.510 upgrade

Dementech
Hello

I'm running an ASG220, and just installed the 7.510 firmware update last night (4/4/11) along with the up2date 21650 definitions.

Since performing the update, and the FW restart, my users are receiving certificate warnings/errors when going to sites that they previously were able to access.

All of the sites are SSL.

Two of the sites could be accessed by clicking the "continue to the page" option and displaying the blocked content, but one gave up an Input/Output error.

Here's some of the pertinent output from the https live log:

2011:04:05-11:53:47 host httpproxy[10925]: [0xa4a00a50] ssl_connect (ssl.c:954) ssl_handshake: Input/output error 

2011:04:05-11:53:47 host httpproxy[10925]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="2188" time="0 ms" request="0xa4a00a50" url="https://***.***.***.***" exceptions="" error="" 

The only way to allow my users to access the sites without issue (almost) is to turn off the proxy.  Obviously I can't keep the proxy off.

It seems like the FW CA is confused because I noticed a prompt when running with the https proxy disabled and hitting one of the sites that offered an option to view the certificate.

The certificate for the site had my email address listed as a contact.
This is the same email address that is on the FW as the admin contact.

These issues did not exist prior to the 7.510 update.

Any ideas?

Thanks in advance for your help.


This thread was automatically locked due to age.
Parents
  • 0
    Usually, I'd expect 502 errors to be fixed by skipping the proxy for that site, but it doesn't make sense that several sites suddenly would start being difficult for the Proxy.

    Since you're the only one reporting this issue, I think you might need to submit a support request.

    Please let us know what the solution was.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    Usually, I'd expect 502 errors to be fixed by skipping the proxy for that site, but it doesn't make sense that several sites suddenly would start being difficult for the Proxy.

    Since you're the only one reporting this issue, I think you might need to submit a support request.

    Please let us know what the solution was.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Cookie Information Banner