SSL Decryption Issues

I assume the error 338 is the most significant part of the message.

I wonder if the server doesn't support "RFC 5746 secure renegotiation" and the client is using OpenSSL 3, which enforces that standard by default.

If you look at the results of these sites here:

https://testtls.com/sso.citrix.com/443

https://testtls.com/sso.cisco.com/443

Both are:

I assume this is what is being picked up?

Apple.com for example:https://testtls.com/apple.com/443

You could check if all the sites you see the error on align with the above scenario.

I suppose you can turn of decryption for the site under: https://cloud.sophos.com/manage/endpoint/config/settings/ssl-tls-decryption

The policy should end up in https_decrypt_excluded_sites under:

HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[latest]\web_protection

Does that help?

I assume the error 338 is the most significant part of the message.

I wonder if the server doesn't support "RFC 5746 secure renegotiation" and the client is using OpenSSL 3, which enforces that standard by default.

If you look at the results of these sites here:

https://testtls.com/sso.citrix.com/443

https://testtls.com/sso.cisco.com/443

Both are:

I assume this is what is being picked up?

Apple.com for example:https://testtls.com/apple.com/443

You could check if all the sites you see the error on align with the above scenario.

I suppose you can turn of decryption for the site under: https://cloud.sophos.com/manage/endpoint/config/settings/ssl-tls-decryption

The policy should end up in https_decrypt_excluded_sites under:

HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[latest]\web_protection

Does that help?

You could be onto something here, all the websites i've checked have come up with the similar results on the TLS checker, I've got a support case open i'll see what they say too. It's a shame they didn't tell us about these extra checks in the latest coreagent release if that's the case. 

Another option to test would be to use openssl, e.g:

"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" s_client -tls1_2 -connect sso.citrix.com:443

That returns "Secure Renegotiation IS NOT supported". If it is supported you can hit R and it will renegotiate, for the main domain it will work, e.g.:

"C:\Program Files\OpenSSL-Win64\bin\openssl.exe" s_client -tls1_2 -connect citrix.com:443

The feature of SophosNetFiler.exe has always been there, I wonder if a shift to OpenSSL 3 is the change?

As suggested, access to the site is being blocked due to the server not supporting Secure Renegotiation and therefore considered vulnerable to CVE-2009-3555. This check was new to OpenSSL 3 which was updated in this release.

To resolve the problem we will release an update of the 2023.1 Core Agent which disables the OpenSSL setting for now and we will investigate options to let customers determine whether they want to allow or block access to these sites. We expect to have that available next week. Customers who run into the problem can resolve most easily by allowing access to the site via Web Control policy or use Update Management policies to apply a previous Software Package.