3CX DLL-Sideloading attack: What you need to know
We are using a Sophos XGS2300 (SFOS 19.0.1 MR-1).
We uploaded a pfx-certificate to the WAF which specifically included only the webserver certificate itself and its intermediate certificate.
But, when we check the site with a tool like https://www.ssllabs.com/ssltest/ we see that the server (e.g. the Sophos Firewall) also sends the root certificate. Which is not what we want and which we don't see when we check sites like microsoft.com.
Are we correct to assume that this is done by the XGS? Is that intentional? Is there a way to circumvent this?
Is the CA from the certifcate path availabe on your FW?
I, f.i. had to upload the CA of my Let's Encrypt certificates.
And SSL Labs shows ISRG Root X1 as the CA, not my Sohos FW.
Hi, thanks for the input.Yes, the CA is already available in the FW. The certificate in question is a "normal", bought certificate from a certificate retailer. The CA is a globally known root CA. It's not a Let's Encrypt certificate.