Sophos SSL VPN issue on 2.3 version - Case 07368183

Can you share the content of your current used OVPN File? Because with 2.3 we updated also openvpn to a secure version and it could potentially make older / insecure options not valid anymore. 

client
dev tun
proto tcp
verify-x509-name "C=IN, ST=Gujarat, L=Ahmedabad, O=Cyberoam, OU=Cyberoam Appliance, CN=CyberoamApplianceCertificate_C18615277667, emailAddress=info@cyberoam.com"
route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
nobind
persist-key
persist-tun

</key>
auth-user-pass
cipher AES-128-CBC
auth SHA256
comp-lzo yes
;can_save no
;otp no
;run_logon_script no
;auto_connect
route-delay 4
verb 3
reneg-sec 0
remote  8443 tcp-client

above content of OVPN is working properly in Sophos Connect 2.2 & all the older version..

Hi umesh prajapati Thank you for sharing the case details with us. I reviewed the error observed while connecting with SSL VPN with Sophos connect 2.3 and your reported issue is getting matched with an existing open investigation "NCL-1852" where Dev is investigating a similar kind of situation reported to us. 

A new Support case 07393422 has been raised for this to work on it and to collect the required logs to review it and to confirm whether your situation matches with the above ID or not. One of our Support engineers will connect with you on the case to work further on this.

Rest assured I will personally keep an eye on the progress of the new case.

Hello Umesh,

Regret to hear about your experience on this concern.

We are now aware of your new support case - 07393422 and tracking progress on our end. 

The latest activity of the engineer assigned to the case shows that he tried to reach out to your registered mobile number, but you were unable to answer.

Could you please provide your availability on the case thread so the call can be arranged accordingly, 

Many thanks for your time and patience and thank you for choosing Sophos.

Regards,

Please connect now, I am available

Any solution from dev side ?

I have shared logs with Haardikh. You can check via the below URL.

easyupload.io/m/9pihu7

Hi umesh prajapati  I reviewed the submitted logs and as suspected in my previous comment your issue is matching with ID NCL-1852 as per the logs.

2024-06-17 13:34:30 VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=IN, XXXXXX.... 
2024-06-17 13:34:30 Sent fatal SSL alert: bad certificate
2024-06-17 13:34:30 OpenSSL: error:0A000086:SSL routines::certificate verify failed:
2024-06-17 13:34:30 TLS_ERROR: BIO read tls_read_plaintext error
2024-06-17 13:34:30 TLS Error: TLS object -> incoming plaintext

Since OpenVPN has been updated in the Sophos Connect 2.3 client, it fails to connect to SSL VPN behind Sophos XG when the server certificate authority uses a weak signature algorithm like SHA1.

The Sophos Connect 2.2 client is not affected as it still accepts SHA1.

You will also receive an update on the support case with the next POA/workaround details.

I hope the above information and clarification will help you with this.

What is the solution for this?

We can't regenerate the certificates. Its very difficult for us to install the certificate again on all 100 users & also setup SSL VPN with ovpn file again..

Why Sophos not implemented in Sophos Connect 2.3 version.. you will have to update the backward support certificate in new application 2.3 also Please check with dev team and resolve this.