Problem with a FAKE SSL certificate Sophos is creating!

Hello,

Not only the Sophos Firewall, every router that does Decrypt and Scan, and users who don't install the certificate will cause this. Most likely, the admin incorrectly configured the Wireless for guest access to do that. It’sn’t common, but it does happen. Not your issue or your website issue.

Regards,

Hello again,

Thank you. I am trying to digest what you are saying as a simple business owner...

So to be clear, you are saying that when I use my iPhone's safari browser and go to a website like  www.science-ritecbd  or  www.science-ritehemp.com,  which have their own SSL from DigiCert which I pay annually for on both sites, all PUBLIC/GUEST WIFI's such as SOPHOS install a certificate on my iPhone in order to use the Wi-Fi, Correct?

In this situation, when I went to go to  www.science-ritehemp.com,  the SOPHOS firewall did not see that I had an SSL installed on  www.science-ritehemp.com,  or did not care, and installed it's own SSL certificate on my phone. Either way, after the SSL certificate was installed on my iPhone, it still did not allow me to connect to the website. See image below for confirmation that a SOPHOS SSL certificate was installed on my iPhone, which curiously matches my DigiCert's SSL exact dates for start and expiration.

Correct me if I am wrong, but it appears that the SOPHOS Wi-Fi Firewall  DID INSTALL a SSL CERTIFICATE  and then said it was suspicious and labelled it as fake. It confused itself because my website had a SSL certificate installed from DigiCert, it went and created another one, and said it was IMPERSONATING my website and not secure. Again, look at the images below confirming that a SOPHOS SSL CERTIFICATE, IN FACT, WAS INSTALLED on my iPhone.

Thanks again for trying to articulate this and I look forward to your response.

Johnathan

You can read about this here:  Sophos Firewall: HTTPS Decrypt and Scan FAQ 

Basically it is common practice, to do this for your own devices. Seems like the Architect of this particular SFOS appliance did not pay attention. 

Hi Emmanuel,

Thank you.

I have been trying to understand your statement above. As well, I done my best to read LuCar Toni 's recommendation:   Sophos Firewall: HTTPS Decrypt and Scan FAQ 

I am still lost as to why Sophos would issue a certificate and not have it accepted by Safari and Google Chrome on my iPhone. It is strange that Safari and Google Chrome don't trust the Sophos Certificate...Do they realize that it is not the real SSL certificate or that is is SELF-SIGNED?

Either way, in the next few days, I will test using a FireFox Browser and also uninstall my AVG Security Bundle and AVG VPN and then re-boot and see if that helps.... I will also run IP Trace Route with my Network Analyzer Lite software on my iPhone both on the Sophos WiFi and 5g from the same location.

I really hope that this is an isolated situation and not going to happen for others trying to access my websites..

Would you be able to use an iPhone and try to accessing my websites www.science-ritecbd.com and www.science-ritehemp.com to see if going through your own/companies Sophos WiFi Router to see if you get blocked? I would really appreciate this to really narrow the issue down. 

Lastly, is their any data base I can register on within Sophos to store my trusted ssl certificates? 

Here are the results from a few different SSL Tester sites:

https://www.ssllabs.com/ssltest/analyze.html?d=www.science-ritecbd.com

https://www.sslshopper.com/ssl-checker.html#hostname=www.science-ritehemp.com

https://dnschecker.org/ssl-certificate-examination.php

https://www.immuniweb.com/ssl/www.science-ritecbd.com/I8ViGyUq/

Thanks again,

Johnathan

Hello,

So if you want to be more clear about what is happening, the next time you connect to the Hotspot, go to the website and click the "visit this website" Then the next screen will most likely be a "Stop. This website is blocked." and the reason or an SSL connection dropped or a warning certificate if the site loads.

You’re going far and above for a simple proxy issue; I recommend you reach out to a consultant to explain what is happening, as you’ll be investing a lot of time and energy in "solving" something that isn’t in your hands to "solve", not because you can't but because the Administrator of that hotspot is simply blocking access to certain websites categories and using the Proxy option.

Regards,