Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 17 subscribers
  • Views 4288 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Certificate for Sophos Web Protection Warnings?

Sophos ma-edv

Hello,

I need to reopen the question from an older "comment" by Robert, seen here:
(https://community.sophos.com/intercept-x-endpoint/f/discussions/122473/certificate-for-sophos-web-protection-warnings)

As most of the web is ssl by now, a lot of our users continously raise tickets about ssl errors, as they don't see, that the site is blocked by sophos/design/management request.

Expected behaviour:
* User must be made aware of that the site is blocked through web control/sophos and not because of some ssl error

This for sure can be achived by sticking a CA Certificate in AD or by some kind of popup through the sophos client or something else. It used to work onsite (UTM) with pushing an additional CA cert out to the clients, but we are certainly open for other solutions.

Please provide any solutions besides switching the software?



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Sophos ma-edv

    Hello  ma-edv ,

    not a myth (as others, AFAIK, already do it).  Sorry if stating the already obvious. Traffic redirection is there, and interception, scan and/or injection not a challenge when HTTP is used.  While you can read HTTPS traffic you can't modify it as you'd need the sending server's private key. The solution is to "cut" the connection in two, On the one from/to the browser the server must be mimicked, and for this a root CA must to be installed that is used to issue the pretended server certificate.

    Christian    .

Children
  • 0 in reply to QC

    Fully agree. No one denys that from a technical prospective; we know this "old school feature" from the UTM anyways. But User 930 was stating that there will be that functionality in the new Web Protection/Control.

    But at this time, there is no official annoucment from Sophos about introducing it as a "brand new" feature Slight smile

  • 0 in reply to QC

    By the way, this is not entire true anymore. While old school proxies do this (split into two sessions), DPI engines like SFOS (XGS) are actually using the stream. Therefore the packet will be manipulated while flowing through the firewall and not building up a own connection. But the premise is still the same, you have to trust the certificate anyway from the firewall. 

    __________________________________________________________________________________________________________________

Unfiltered HTML