"ssl_error_bad_mac_alert" "PR_END_OF_FILE_ERROR"

Hi Alexander,

Thanks for reaching out to us. 

Looking into some of our previous support-cases, the following setting changes on the Sophos Firewall have had some positive results for other customers. 

- tcp-selective-acknowledgement deactivated
- firewall-acceleration deactivated
- restrict client traffic during identity probe deactivated

Let me know if this works for you.

Hello Lakhan, thanks for the answer.

We are not using a Sophos Firewall on the customer side.

the customer has only installed sophos central intercept X Endpoint protection.

PR_END_OF_FILE_ERROR usually happens when Sophos Endpoint updates IPS patterns or NTP module and is fixed by Browser restart. I have never seen the error to disappear before I restarted the browser. Mostly firefox.

You can check these events from this log and align them with the reports of your users.

C:\ProgramData\Sophos\AutoUpdate\Logs\SophosUpdate.log

search for " Installing component"

I have never seen the other MAC message.

we have this Problem since 3 Weeks already, we have restarted the Browser and the Computer multiple Times.

And the Issue resolves itself most of the times by just waiting 5 Minutes.

But i will check the Logs.

Hello Alexander,
we have exactly the same problem. The error message is displayed during a Google search in FireFox and disappears by itself after 5min. However, I have noticed that the error does not occur with another search engine in FireFox or another browser.
Have you already found a solution?

is there a XG with webfilter in that network?

We also use Sophos Endpoint Protection and have exactly the same problem with Firefox and Google Search.

I would be very interested in a solution.

We do not use a Sophos XG

We have an XG, but the web filter is not active, as in your screenshot.
I suspect HTTPS decryption for us, but I'm still testing with individual users.

Hi Ryaco,

we have the same Problem, every 5 Minutues we can't access Google seach, Gmail an Youtube.

our solution is to disable "Block access to malicious websites" under "Real-time Scanning - Internet"

But i think this is not the best solution.

I think the Problem is also not the Firewall because our Firewall is a Sophos UTM and everything works fine before i installed Intercept X Advanced with XDR .

Hi Ryaco,

we have the same Problem, every 5 Minutues we can't access Google seach, Gmail an Youtube.

our solution is to disable "Block access to malicious websites" under "Real-time Scanning - Internet"

But i think this is not the best solution.

I think the Problem is also not the Firewall because our Firewall is a Sophos UTM and everything works fine before i installed Intercept X Advanced with XDR .

hi together,
my tests with HTTPS decryption disabled unfortunately showed no success. Does anyone have any other findings or suggested solutions?