Safeguard Enterprise server over Internet not via VPN

Having trouble when syncing with SafeGuard when not connecting via VPN, after looking at this thread: 

https://community.sophos.com/encryption/f/discussion/104413/clients-connect-to-safeguard-enterprise-server-over-internet

We have this setup, but get this error when running SGNCSCC.exe tool.



Pic
[edited by: Dan Petford at 11:19 AM (GMT -8) on 11 Jan 2021]
  • Can you route to the website in a browser? 

    If you can - does the page display properly?

    On the SGN server - do an invoke test and see what it returns.

    RichardP

    Snr. New Product Introduction Engineer | CISSP | Sophos Technical Support
    Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • We renewed a certificate on our secondary server, would that effect it?

  • Yes it would Dan - Did you use a public cert or is it an internal one? Public ones will require that the intermediary certs (if needed) are accessible. We do this via GPO to all the AD bound machines, but if it's an internal cert the clients will need a copy of the certs. Creating a new configuration file and applying this to the clients would resolve as the config file contains the certs needed-  but you then have the hassle of applying the new config file to every client.....

  • It was an internal one, but surely just renewing, why does it cause this issue, because then we have to change something every time it expires. What do we have to change to the config file? This is for domain users

  • The SSL cert secures communication between the host and client so it's critical. I understand your frustration - I had exactly this challenge last year and despite Support suggesting otherwise, I was able to get away with it as I used an externally minted cert - so the clients picked up the change straight away as soon as I switched the cert over and restarted IIS. You have a few options though since they're domain bound but this would HAVE to have access to your AD/GPO. This works for physical PC's on site but if you have laptops and don't have an always on VPN then it's more of a challenge! When you create a config file on the server, it creates an MSI file. This contains some XML/config AND the certs. This is the easiest method of doing it to be honest - but as I said...needs installing/running on every client. 

    This is common though for certs and not a fault of Sophos as such . I do though wish there was better functionality for this, but also appreciate the security constraints of this. If the client could update itself/update certs in the same way it can do policies....we'd be onto a winner! This is made worse by the recent validity period being reduced for certs too-  most are only a year now so this is a more common event than it was!

    So - Push out the certs with AD/GPO to the domain bound clients (is the SSG server not bound to the same domain?) or create a new config file and apply it to the client.

    Personally - I'd create a new config file anyway - apply it to the one client you've pictured - reboot and then test all works again?

  • Yes the SGS Server is on the same domain

  • Then you could push out all the certs from the DC? How many PC's are there?

  • About 200 plus, it's fine when connected via our vpn for domain users, but it's more of an issue with the WORKGROUPS now not able to sync

  • Ah ha, you have domain bound AND Workgroup? Obviously you'll not be able to use the DC to push out to those and as it's an internal cert your easy options are limited. I would create a new configuration file and install that. Unless the WG PC's are managed by some sort of MDM?

  • No unfortunately, our Domains will be fine as the certs gets pushed out but it was more for our workgroups, but because we found that when our domains weren't connected via the vpn it was erroring when syncing but that's because our secondary server which is setup for that the cert expired and was renewed.