Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Replies 14 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 2269 views
  • Users 0 members are here
Options
Suggested

Bypass - The trust status of this website's certificate could not be securely established.

midnightSun

Good Eve.

Trying to connect to a network switch via https. 

Error page : The trust status of this website's certificate could not be securely established.

About this request

URL: https://somePublicIP   

  • Certificate details:
    • Valid From: Feb 19 03:51:01 2024 GMT
    • Valid To: Feb 18 03:51:01 2025 GMT
    • Serial Number: 57:60:17:61:a4:06:e2:5b:92:2b:95:5b:85:5f:62:1d
    • Subject: C= , ST= , L= , CN=192.168.0.2, O= , OU=
    • Issuer: C= , ST= , L= , CN=192.168.0.2, O= , OU=

Its a self signed cert the device created. I know it works and I'm the only IP that can connect via the other sides firewall rules. It works bypassing SFOS.

In SFOS

I've added the public IP to every place i can think of to allow the connection. 

I've created a URL group with the IP and added it to the policy.- I'm blocking urls with IPAddresses

I've added it to the Local TLS exclusion list 

I've created an web exception

I've created a SSL/TLS inspection rule exemption

I've run conntrack -F

What am I missing? At this point id expect SFOS to totally ignore the IP.

An old post talked about adding the devices Cert to SFOS but that would be impossible if you cant connect to it. Shouldn't SFOS be skipping its checks by now?

All help would be greatly appreciated.



Added TAGs
[edited by: Erick Jan at 3:08 AM (GMT -7) on 15 Apr 2024]
  • 0 in reply to LuCar Toni

    So I found turning off "Block invalid Certificates" allows the site.

    Anyway to keep this enabled but still bypass the proxy for a website with an invalid cert?  Exceptions and such still seem to be scanned by the proxy.

    Do you use the TLS DPI Engine as well? 

    echo "           __     __         __         __     __    _______               ";
echo ".--------.|__|.--|  |.-----.|__|.-----.|  |--.|  |_ |     __|.--.--..-----.";
echo "|        ||  ||  _  ||     ||  ||  _  ||     ||   _||__     ||  |  ||     |";
echo "|__|__|__||__||_____||__|__||__||___  ||__|__||____||_______||_____||__|__|";
echo "                                |_____|                                    ";

    ~~~ I miss Port 17. Remember using telnet to get the Quote of the Day? Maybe I'll set one up for all the port scanners.  ~~~ 

  • 0 in reply to rfcat_vk
    rfcat_vk said:
    A simple web exception for the destination ip with do it scan https ticked. Next a firewall rule at the top allowing the selected ip address as the destination

     The Proxy "Exceptions" don't seem to honor exceptions as one would think. The Proxy is still inspecting these sites.

    Sophos writes " With exceptions, you can override protection settings for all web traffic that matches the specified criteria, regardless of any policies or rules in effect."

    See above for the settings that are causing my problem.

    echo "           __     __         __         __     __    _______               ";
echo ".--------.|__|.--|  |.-----.|__|.-----.|  |--.|  |_ |     __|.--.--..-----.";
echo "|        ||  ||  _  ||     ||  ||  _  ||     ||   _||__     ||  |  ||     |";
echo "|__|__|__||__||_____||__|__||__||___  ||__|__||____||_______||_____||__|__|";
echo "                                |_____|                                    ";

    ~~~ I miss Port 17. Remember using telnet to get the Quote of the Day? Maybe I'll set one up for all the port scanners.  ~~~ 

  • 0 in reply to midnightSun

    Could you not just create a firewall rule higher in the chain for traffic to the NOC to not decrypt and not use web proxy? So a special rule just for this purpose where you do not decrypt the traffic?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    I probably could as a work around, but shouldn't proxy exceptions work? Seems to be a bug. 

    echo "           __     __         __         __     __    _______               ";
echo ".--------.|__|.--|  |.-----.|__|.-----.|  |--.|  |_ |     __|.--.--..-----.";
echo "|        ||  ||  _  ||     ||  ||  _  ||     ||   _||__     ||  |  ||     |";
echo "|__|__|__||__||_____||__|__||__||___  ||__|__||____||_______||_____||__|__|";
echo "                                |_____|                                    ";

    ~~~ I miss Port 17. Remember using telnet to get the Quote of the Day? Maybe I'll set one up for all the port scanners.  ~~~ 

Unfiltered HTML