Sophos Endpoint Updates over https

We've been looking at supporting https in Sophos development for a long time (we do regularly get requests for it). From a software development point of view, adding support for https would obviously be easy, which is why people are often surprised that we don't offer it.

The main reason we don't currently provide this is the difficulty of providing a sufficiently 'brilliantly simple' way of configuring https that won't be error-prone and risk breaking updates. We are very careful about infrastructure changes that could cause updating failure on a large scale, as it can compromise endpoint protection and can be hard to recover from such a situation.

The difficulty and risk in using https is in the management of the certificates used by the https server.

There are three main ways that this can be done:

1) Get a certificate from one of the usual trusted CAs (e.g. Verisign). This is an additional cost and process. More dangerously, these need to be renewed frequently, and forgetting to do so would then break updating of the endpoints for an entire site.

There is also a potential failure case where endpoints don't have a sufficiently up-to-date lists of CA certificates. This could also break updating.

2) Use a site specific certificate (e.g. a self-signed one).

This adds the additional complexity of having to get the appropriate public certificates onto the endpoint. This could be tricky to set up, and again is another potential failure point.

This also can cause problems with some proxies that check certificates.

We are currently considering ways this could be made easier.

3) Don't check the certificate validity.

Sadly, a lot of https clients side-step the certificate management issue and take this approach. However, with such a set-up it's easy to perform a man-in-the-middle attack, so the https adds little security benefit. As a security company we couldn't really recommend this.

For those of you who want to use https, it would be helpful if you could tell us how you would want to configure your servers, so we could look at supporting the particular use cases.

We've been looking at supporting https in Sophos development for a long time (we do regularly get requests for it). From a software development point of view, adding support for https would obviously be easy, which is why people are often surprised that we don't offer it.

The main reason we don't currently provide this is the difficulty of providing a sufficiently 'brilliantly simple' way of configuring https that won't be error-prone and risk breaking updates. We are very careful about infrastructure changes that could cause updating failure on a large scale, as it can compromise endpoint protection and can be hard to recover from such a situation.

The difficulty and risk in using https is in the management of the certificates used by the https server.

There are three main ways that this can be done:

1) Get a certificate from one of the usual trusted CAs (e.g. Verisign). This is an additional cost and process. More dangerously, these need to be renewed frequently, and forgetting to do so would then break updating of the endpoints for an entire site.

There is also a potential failure case where endpoints don't have a sufficiently up-to-date lists of CA certificates. This could also break updating.

2) Use a site specific certificate (e.g. a self-signed one).

This adds the additional complexity of having to get the appropriate public certificates onto the endpoint. This could be tricky to set up, and again is another potential failure point.

This also can cause problems with some proxies that check certificates.

We are currently considering ways this could be made easier.

3) Don't check the certificate validity.

Sadly, a lot of https clients side-step the certificate management issue and take this approach. However, with such a set-up it's easy to perform a man-in-the-middle attack, so the https adds little security benefit. As a security company we couldn't really recommend this.

For those of you who want to use https, it would be helpful if you could tell us how you would want to configure your servers, so we could look at supporting the particular use cases.