Sophos SSL VPN issue on 2.3 version - Case 07368183

Hello Umesh,

Regret to hear about your experience on this concern.

We are now aware of your new support case - 07393422 and tracking progress on our end. 

The latest activity of the engineer assigned to the case shows that he tried to reach out to your registered mobile number, but you were unable to answer.

Could you please provide your availability on the case thread so the call can be arranged accordingly, 

Many thanks for your time and patience and thank you for choosing Sophos.

Regards,

Please connect now, I am available

I have shared logs with Haardikh. You can check via the below URL.

easyupload.io/m/9pihu7

Hi umesh prajapati  I reviewed the submitted logs and as suspected in my previous comment your issue is matching with ID NCL-1852 as per the logs.

2024-06-17 13:34:30 VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=IN, XXXXXX.... 
2024-06-17 13:34:30 Sent fatal SSL alert: bad certificate
2024-06-17 13:34:30 OpenSSL: error:0A000086:SSL routines::certificate verify failed:
2024-06-17 13:34:30 TLS_ERROR: BIO read tls_read_plaintext error
2024-06-17 13:34:30 TLS Error: TLS object -> incoming plaintext

Since OpenVPN has been updated in the Sophos Connect 2.3 client, it fails to connect to SSL VPN behind Sophos XG when the server certificate authority uses a weak signature algorithm like SHA1.

The Sophos Connect 2.2 client is not affected as it still accepts SHA1.

You will also receive an update on the support case with the next POA/workaround details.

I hope the above information and clarification will help you with this.

Hi umesh prajapati  I reviewed the submitted logs and as suspected in my previous comment your issue is matching with ID NCL-1852 as per the logs.

2024-06-17 13:34:30 VERIFY ERROR: depth=0, error=CA signature digest algorithm too weak: C=IN, XXXXXX.... 
2024-06-17 13:34:30 Sent fatal SSL alert: bad certificate
2024-06-17 13:34:30 OpenSSL: error:0A000086:SSL routines::certificate verify failed:
2024-06-17 13:34:30 TLS_ERROR: BIO read tls_read_plaintext error
2024-06-17 13:34:30 TLS Error: TLS object -> incoming plaintext

Since OpenVPN has been updated in the Sophos Connect 2.3 client, it fails to connect to SSL VPN behind Sophos XG when the server certificate authority uses a weak signature algorithm like SHA1.

The Sophos Connect 2.2 client is not affected as it still accepts SHA1.

You will also receive an update on the support case with the next POA/workaround details.

I hope the above information and clarification will help you with this.

What is the solution for this?

We can't regenerate the certificates. Its very difficult for us to install the certificate again on all 100 users & also setup SSL VPN with ovpn file again..

Why Sophos not implemented in Sophos Connect 2.3 version.. you will have to update the backward support certificate in new application 2.3 also Please check with dev team and resolve this.

Hi umesh prajapati  - We have made a note of this issue and there's a plan to fix this in the upcoming MR.

Thanks.

I have the exact same issue with one of my firewalls as well. Worst part is the client on the unit pushes 2.3 so having to manually send the 2.2 client to users when they are setting up. Look forward to seeing the resulting fix.

Please do your process fast to provide the new upcoming MR build.

Hi umesh prajapati  Sophos Connect 2.3 MR1 contains the solution for your reported issue is now released:

community.sophos.com/.../sophos-connect-2-3-mr1-update-released