Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 39 subscribers
  • Views 2610 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with NET::ERR_CERT_AUTHORITY_INVALID still present?

Andrej Pirman

Hi,

I have ONE of 3 new installs of XGS-126 having long known problem with Sophos CA certificates on some popular URL addresses. For example, users cannot download Google Chrome:

I guess problem is HSTS, where browser detects MITM, which is Sophos box. 

I already disabled microapps in console, recreated CA certificate, restarted Tomcat service...but beside this being ridiculous after so many years, it still does not work. Went through dozens of forums and threads here, but cannot find a solution.

Any idea, hint? Please & thanx!



This thread was automatically locked due to age.
Parents
  • +1

    UPDATE - SOLVED: 

    As it turned out after examining firewall logs, it was "DEFAULT" WEB POLICY, which is blocking unwanted freeware, clasifying Google Chrome as unwanted app. Changing WEB POLICY in firewall rule to something else, for example "Default Workplace Policy" resolved the issue.

    Maybe Sophos could put some effort into resolving the behavior in such a way, that it would be clear to user and administrator whet's going on, instead of just letting HSTS do it's job. In technical equivalent it would be like, nevermind brake failure, let it just hit the wall, it is designed to absorb impact.

  • 0 in reply to Andrej Pirman

    Hello  ,

    Thank you for the quick update. Your feedback is well taken and we shall check with the team if the changes can be accommodated. 

    Mayur Makvana
    Technical Account Manager | Global Customer Experience
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question please use the 'Verify Answer' button.

Reply Children
Unfiltered HTML