EAP SSL-TLS Scanning: Category Exclusions and Firewallmanagement not working

skipping e.g. deutsche-bank.de  (a german financial institute) with the URL Exclusion list, you can see, it is not scanning SSL:

Result is:

-------------------------

and now again removed the URL exclusion in Central:

scanned by Sophos

excluding IP addresses or IP subnet's in Central does not work - the client is ignoring the setting and keeps hijacking SSL connection.

from help:

does anyone care about the IP exclusions not working? What's the use of the EAP Forum then?

an update to "category exclusions" - that's now working. i interpreted the switches the opposite way. needs to be on/green to exclude.

This is my first week of running with SSL decryption turned on for my general work system and I'm seeing this same issue, and others.

- Accessing internal system managements interfaces using IPs excluded from decryption fail with PR_CONNECT_RESET_ERROR (firefox) and ERR_CONNECTION_RESET (chrome)

- Related to IP exclusions, accessing internal system management interfaces using non-FQDN names are not properly excluded

- Various sites fail intermittently with the error SEC_ERROR_REUSED_ISSUER_AND_SERIAL, then work after 10-15 seconds

- Some pages simply fail to load, such as https://chromereleases.googleblog.com/ or https://www.brightcloud.com/tools/url-ip-lookup.php

In general, there will need to be some serious reliability improvements to this component for us to enable this functionality across our organization.

stoomart said:

- Various sites fail intermittently with the error SEC_ERROR_REUSED_ISSUER_AND_SERIAL, then work after 10-15 seconds

thats usually with firefox open while Sophos endpoint updates are installed in the background. Typical is IPS. had this today again. then you need to close all browser processes and start a fresh session. EP module updates break their ability to do the man in the middle SSL scan for opened browsers.

I can open both of your links fine, though, reencrypred by Sophos Endpoint RSA Root CA

then it happens, that they're not able to update their program

stoomart said:

- Various sites fail intermittently with the error SEC_ERROR_REUSED_ISSUER_AND_SERIAL, then work after 10-15 seconds

thats usually with firefox open while Sophos endpoint updates are installed in the background. Typical is IPS. had this today again. then you need to close all browser processes and start a fresh session. EP module updates break their ability to do the man in the middle SSL scan for opened browsers.

I can open both of your links fine, though, reencrypred by Sophos Endpoint RSA Root CA

then it happens, that they're not able to update their program

LHerzog said:

Various sites fail intermittently with the error SEC_ERROR_REUSED_ISSUER_AND_SERIAL, then work after 10-15 seconds

that also happens when your network connectivity changes. You move with your notebook to a different location, plug LAN cable etc. Need to close and reopen browser.

I certainly hope this gets fixed by Sophos soon. Myself and our IT Director are currently in the EAP testing the SSL Decrypt functionality on our workstations and we've been seeing the Firefox error with all of our organization's URLs (we use a wildcard cert.) We've since exempted *.ourdomain.edu and it seems to have taken care of it, with the exception of our firewall's management panel, which we connect to via IP address. As you mentioned, Sophos is not honoring IP address exemptions. Thankfully, with it only being us two using that, and neither of us using Firefox as a primary browser, it's not a big deal for now.

However, given this plus other issues I'm seeing as suggested topics at the right, this feature still needs a lot of work before it sees general rollout.