How to setup a CA that supports latest Requirements for Apple iOS13 / macOSx Catalina

Question

Dear all, 
 i'm really struggling with the latest update for iOS / macOS where Apple has changed the requirements for SSL-Certificates. Using HTTPS Decryption + Web Policies (e.g. Advertisment filtering) does not work anymore with the Sophos SSL CA Certificate. 
 
 I tried to setup a own CA but i'm not able to get this scenario up and running.. 
 
 Does anybody have an information / how-to / guide what needs to be done i would really appreciate if you can share this to me. I'm using the XG as FW for home usage only.. 
 
 Thanks! 
 Best Regards Martin

FormerMember · Accepted Answer

Hi rfcat_vk, 
 This issue is already resolved with firmware release SFOS 17.5.9. Please check release note : SFOS 17.5 MR9 Released . 
 Please search for NC-50172 in release note. 
 Thanks,

FormerMember · Answer

Hi s.reutemann, 
 The firmware version you provided is for Sophos UTM and this thread is for Sophos XG firewall. 
 The issue has been reported as bug with ID NUTM-11345 (Regenerated Signing CA using 1024bit key, causing iOS 13 trust issues). 
 The fix is going to be released in the firmware version 9.7 MR1 (9.701). 
 There is a possible workaround to this issue, please check answer posted by me on this post: https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/117486/sophos-utm-web-protection-https-ca/424699#424699 
 Thanks,