blocked HTTPS websites only show SSL_ERROR_RX_RECORD_TOO_LONG when Web Control is enabled

Question

users reported sites not loading showing the error SSL_ERROR_RX_RECORD_TOO_LONG. 
 this is caused by intercept X Web Control function. 
 When I disable this feature, the websites are loading fine. 
 example: 
 https://www.weihnachtsbaum-heidelberg.de 
 when I check the non https version of the sites, I get a correct error message from intercept X in browser: 
 example: 
 http://www.weihnachtsbaum-heidelberg.de 
 
 This is blocked to offensive content which is also wrong. 
 Firefox reports SSL_ERROR_RX_RECORD_TOO_LONG 
 IE just says the page cannot be displayed 
 Edge Chromium says ERR_SSL_PROTOCOL_ERROR

Sophos, what is the problem with the SSL_ERROR_RX_RECORD_TOO_LONG error, are you using a bad certificate in Intercept X?

Sophos User930 · Accepted Answer

This is expected as the endpoint proxy doesn't man in the middle HTTPS so it can't inject a block/warn page as it does for HTTP. 
 You should see the alert for it in the events report though in the UI. 
 The upcoming replacement I gather will do SSL inspection at the client. 
 You will also see in: "C:\ProgramData\Sophos\Health\Event Store\Trail\" the JSON for the alerts. These "events.sav.webcontrol.block" type events are set with "showNotification":false so there is no desktop popup from the UI up as you would be inundated potentially. 
 The old "on-premise" client used to alert all with poups by default and there was a registry key to disable it back then: Service and Support (sophos.com)

blocked HTTPS websites only show SSL_ERROR_RX_RECORD_TOO_LONG when Web Control is enabled

Top Replies