SEC_ERROR_EXPIRED_CERTIFICATE for web proxied sites

 Hello Tim M,

Thank you for reaching out to the community, are you facing this with all the sites or few selected sites ?
From the advance shell can you share the output of the following command:
> ls -larth /var/certcache/ | grep youtube.com

Hi Vivek Jagad!

It does not appear to be affecting all sites I proxy (I don't proxy everything - just things from certain categories). For example, craiglist is proxied and the cert if provides from the firewall is valid until February. From what I can tell, it's affecting just google related sites at this time. I'll keep looking to see if I can find any others it affects, though. [edit: looks like it happens to bing.com too, with nearly the identical expiration date (Mon, 11 Jul 2022 14:19:20 GMT).]

Also, here's the output from the command:

Thanks!!

Hi,

if you haven't configured the proxy in your firewall rules then you are using the DPI which scans all traffic. Try changing your certificate to the XG default.

Ian

Hey Tim M, In this case try deleting the certcache for youtube.com by executing following command: rm www.youtube.com#1 
similarly for rest of the youtube domains and then check if you are facing the same issue again on youtube ?

Hey Vivek Jagad. Tried this with youtube and bing, to no effect. The issue persists and seems to be using the same certs still, despite the cache being cleared out for those domains.

Hi rfcat_vk,

I am using both DPI and web proxy. DPI for everything except for app enforcement domains... which are set to use the proxy.

As suggested, I did change the cert being used for the SSL settings from "SecurityAppliance_SSL_CA (RSA)" to"Default (RSA)", and that seems to have given me a new cert for those domains with a 2024 expiration! But, since my browser doesn't trust the cert issuer, I'm getting an " SEC_ERROR_UNKNOWN_ISSUER". I toggled the certificates back to the origincal one "SecurityAppliance_SSL_CA (RSA)" and that seems to have jiggered whatever was stuck and now things are working again!

And here too:

So, to be clear... toggling this from "SecurityAppliance_SSL_CA" to "Default" and back to "SecurityAppliance_SSL_CA" again seems to have solved the problem. Bing and Youtube are now loading with new, non-expired certificates.