This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Connect SSL warning message

This message pops up when I try to connect. We have other people using the same setup without issue. Is there something wrong with my config file? It does connect, but it needs to be secure.

My Config file looks like this:
[
{
"gateway": "REDACTED",
"user_portal_port": 443,
"otp": false,
"auto_connect_host": "10.10.10.1",
"can_save_credentials": true,
"check_remote_availability": false,
"run_logon_script": false
}
]

This thread was automatically locked due to age.

Top Replies

Vivek Jagad 7 months ago +1 suggested

Hi Weston Gately , Thank you for reaching out to the community, under the global SSL Settings, what is the certificate used ? Use ApplianceCertificate issued by the default CA when configuring SSL VPN…

Parents

+1 Spencer Smith 7 months ago

Weston Gately

When using a provisioning file as per the configuration above Sophos Connect will connect to the user portal specified at "GATEWAY" to grab the openvpn configuration file for the user that logs in. The message that you're seeing is related to the certificate used on the user portal and is the same as if you were to access it manually at https://REDACTED:443

By default this is a self signed certificate from the firewall which causes this warning to appear.
Cancel
Vote Up +1 Vote Down

Cancel
0 Weston Gately 7 months ago in reply to Spencer Smith

Where can I find what the User portal port is set to?
Cancel
Vote Up 0 Vote Down

Cancel
0 Spencer Smith 7 months ago in reply to Weston Gately

The certificate used for user portal is the same for admin portal, captive portal, spx registration & reply portal

It can be found at Administration > Admin and User Settings > Certificate
Cancel
Vote Up 0 Vote Down

Cancel
0 Weston Gately 7 months ago in reply to Spencer Smith

So, I see the "ApplianceCertificate" is set. Is this certificate not secure or is it possible that it needs to be re-signed?
Cancel
Vote Up 0 Vote Down

Cancel
0 Spencer Smith 7 months ago in reply to Weston Gately

The certificate itself is secure, but the place it comes from is not a trusted certificate authority like DigiCert, Google, GoDaddy, etc. This is a self signed certificate generated by the firewall, so you can trust it's origin but your computer will warn you about it as it's not one of the many trusted CAs.

If you want to ultimately get rid of that warning you'll need to purchase a certificate and upload it to the firewall.

docs.sophos.com/.../index.html
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Spencer Smith 7 months ago in reply to Weston Gately

The certificate itself is secure, but the place it comes from is not a trusted certificate authority like DigiCert, Google, GoDaddy, etc. This is a self signed certificate generated by the firewall, so you can trust it's origin but your computer will warn you about it as it's not one of the many trusted CAs.

If you want to ultimately get rid of that warning you'll need to purchase a certificate and upload it to the firewall.

docs.sophos.com/.../index.html
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Weston Gately 7 months ago in reply to Spencer Smith

Ahh I see. I figured it was self-signed. Despite that, it's not an issue then?
Cancel
Vote Up 0 Vote Down

Cancel
0 Spencer Smith 7 months ago in reply to Weston Gately

If it was your device that signed the certificate, and you trust your device then no self signed certificates would not be an issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 Weston Gately 7 months ago in reply to Spencer Smith

So, this certificate is from GoDaddy. That should mean that it is definitely signed by a trusted CA. Or am I missing something?
Cancel
Vote Up 0 Vote Down

Cancel
0 Spencer Smith 7 months ago in reply to Weston Gately

What certificate?

The SSL VPN certificate is not the certificate used here. The certificate that is causing this warning is the User Portal certificate.
Cancel
Vote Up 0 Vote Down

Cancel
0 Weston Gately 7 months ago in reply to Spencer Smith

We initially thought the previous IT Manager assigned a certificate that was from GoDaddy but we just found that it's not and it's self-signed. I think we understand what's going on now
Cancel
Vote Up 0 Vote Down

Cancel