This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Exposed host and HTTPS Certificates

Hi there,

I have a single static public IP that I'm using for SSL VPN incoming connections and for exposing a host (PBX) along with the following services: 80, 443, 5060, 5061, and RTP range 9999-15000.

The PBX manufacturer provides a DNS service and SSL certificate service. When I try to reach the PBX from the internet via HTTPS, everything works fine. However, when I attempt to access it locally using the DNS address, I encounter a certificate error, and it seems to be related to the Sophos certificate if I check throught Chrome.. Similarly, if I use the local IP address, I encounter the same error, but with an old certificate that expired in 2019.

This is an old Sophos machine that was previously configured for this service, and I'm currently attempting to recover the PBX service.

Thankyou in advance for your help

This thread was automatically locked due to age.

Top Replies

Michael Dunn 9 months ago in reply to pospo2435 +2 suggested

In error conditions or blocks, the XG will force HTTPS decryption in order to display custom block pages. Perhaps you are hitting that. What does Log Viewer say about it? If you use Policy Tester does…

Parents

0 apijnappels 9 months ago

Did you configure SSL inspection inside your network so the SSL traffic is decrypted and the Sophos cert. is inserted back?

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 pospo2435 9 months ago in reply to apijnappels

SSL Inspection isn't configured for the LAN to VoIP access rule.

I really don't understand why I get a certificate errore while reaching PBX locally...
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Dunn 9 months ago in reply to pospo2435

In error conditions or blocks, the XG will force HTTPS decryption in order to display custom block pages. Perhaps you are hitting that.

What does Log Viewer say about it?

If you use Policy Tester does it say the traffic will be decrypted?

If you ignore the certificate warning, does the PBX page load?
Cancel
Vote Up +2 Vote Down

Cancel
0 pospo2435 9 months ago in reply to Michael Dunn

If I ignore the warning the page doesn't load.

Here's the result of policy tester from LAN zone to PBX IP and to the DNS
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Dunn 9 months ago in reply to pospo2435

So Accesso lan VOIP does not have "use web proxy instead of DPI mode" checked which means it is using DPI mode. That means that the SSL/TLS Inspection Rules apply. Do you have SSL/TLS Inspection Rules that are set to Decrypt the traffic?

What is in the Log Viewer for both Web Filter and SSL/TLS inspection?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Michael Dunn 9 months ago in reply to pospo2435

So Accesso lan VOIP does not have "use web proxy instead of DPI mode" checked which means it is using DPI mode. That means that the SSL/TLS Inspection Rules apply. Do you have SSL/TLS Inspection Rules that are set to Decrypt the traffic?

What is in the Log Viewer for both Web Filter and SSL/TLS inspection?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data