Pls help me filling out the Default CA for remote-access SSL VPN !?

Question

Hello, 
 I am running Sophos XG (Home) 18.5.4 MR4 and about to set up a remote-access SSL VPN profile, but changing SSL VPN settings will just not work and settings keep reverting back to default. There have been at least 2 precedences to my knowledge that have things to do with the certificates in the system: 
 _Precedence #1: https://community.sophos.com/sophos-xg-firewall/f/discussions/126620/xg-18-0-4-ssl-vpn-options-do-not-save-apply 
 _Precedence #2: https://community.sophos.com/sophos-xg-firewall/f/discussions/96195/unable-to-save-ssl-vpn-configuration-and-or-download-client 
 Now that I know changing the Default CA (left blank in my system) or re-generating the ApplianceCertificate can fix this, but the latter one can be riskier and thus requiring Sophos Support Specialist. Since I am only a home user, asking for specialists' help can be a hassle. 
 Any Sophos tech support staff here can help me filling out the Default CA, especially the passphrase ? Thank you very much in advance.

LuCar Toni · Accepted Answer

Essentially the issue occur due the case of missing information in contact information. You need to fill out those information on the website with your address etc. 
 This will help for the next time - For this appliance, you need to fill out your information as well as a Private Key Passphrase, which is not needed for anything else. So you can simply leave everything as it is - Fill out your contact information and hit save.

Bharat J · Answer

Hi J Thai 
 When you update the default CA, it's automatically regenerated. 
 If a CA expires or is compromised, you can regenerate it. 
 To regenerate a CA, do as follows: 
 
 Go to Certificates > Certificate authorities . 
 
 To regenerate the default certificate, go to the Manage column and click Regenerate certificate .

Thanks and Regards

LuCar Toni · Answer

Common Name is the hostname of the appliance. This can be a hostname or a FQDN. You do not need to own a domain for that. Hostname is fine.

Bharat J · Answer

Hi J Thai 
 Yes, you can fill as per the hostname like " Default_CA_serial number" as a common name field 
 For more information check : https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/CertificateAuthorities/CertificatesDefaultCAUpdate/index.html 
 Regards

Pls help me filling out the Default CA for remote-access SSL VPN !?

Top Replies