Webadmin Certificate Error NET::ERR_CERT_COMMON_NAME_INVALID

Hi Elizabeth, Thanks for reaching out to Sophos Community.

Try to download and install "SecurityAppliance_SSL_CA" in the end machines and verify again.

Hi.

Well The COMMON_NAME_INVALID is an error that you get, when the URL--Hostname you type does not match the Common Name of the certificate.

So what you have to achieve that the CN-part in details of the certificate (requester) you use for WebAdmin are the same like you provide in the url.

But you provide the IP in the URL. So this could be the problem.

When you want to achieve, that you may use the hostname and IP, you have to generate a certificate with alternative names to be able to access the firewall using with multiple names.

Thanks so much for the info! How do I add alternative names to the certificate? Is it just adding multiple entries to the Common Name field separated by a comma?

Hi DeveshM, I do have this certificate installed. I am still hitting an issue when people are trying to either see the user portal or are hitting the captive portal (for notifications of websites being blocked)

If you're specifically looking to remove the not-secure error form user portal and captive portal, Try to follow this KB : https://support.sophos.com/support/s/article/KB-000036904?language=en_US

Make sure that the common name u put in the Certificate, Should be the IP you’re accessing XG with for user portal and captive portal otherwise it'll throw the error 

Hi Elizabeth Owen.

Well it is not possible from the UI as far as I've seen. Comma separation would not do the job as far as I know.

With SFOS 18 MR5 there are some modifications within the forms that I've not seen yet.(see Sophos (XG) Firewall v18 MR5 (Build 586) is Now Available - Release Notes & News - Sophos (XG) Firewall - Sophos Community )

But in the documentation the SAN certificates have already been mentioned. (see Generate a locally-signed certificate (sophos.com) )

So check the version of your firewall.

Hi Elizabeth Owen 

Did you have a chance to test the creation of the SAN-certificate in SFOS 18 MR5?