Sophos XG : NET::ERR_CERT_COMMON_NAME_INVALID

Hello,

Thank you for contacting Sophos Community!

You may follow below KBA and review:

community.sophos.com/.../sophos-firewall-resolving-not-secure-error-while-browsing-secure-sites

Hello Neil,

I guess you are using some a webproxy or HTTPS inspection when coming/going through the VPN. Then this involves the certificate form the proxyserver itself. You should deploy the CA of this cert to your vpn clients.

Best thing would be a screenshot of the errormessage with the cert detail infos.

Good morning, 
I have tried the steps detailed in the linked article but disabling Microapp discovery has not resolved the issue unfortunately.

Morning Phillip, 

Thanks for coming back to me. 

I believe I have attached the screenshots below that you requested but please let me know if you need something else.

The error I get now has changed to be bottom image, however this website can still be accessed fine external to our network. 

Cert Details?

Web Site Error

Web Proxy setup? (Note ports 21 and 70 also listed just out of view).

Thanks again.

Hello,

I have tried opening the website at my end and receiving the same output. I suggest raising the support case to investigate.

Hi Neil Wilkinson ,

Thank you for reaching out to the community, Remove the common name and place the host name in the alternative name csr, reissue the certificate, that should solve your problem. Refer - RFC 2818.

Hi Vivek Jagad 

After all the steps mentioned above I'm still experiencing this issue.

For me it's exactly as described in the KBA Article linked by Mayur Makvana . The fix sets the values to the ones that were already configured:

I'm trying to access https://google.com however I'm getting a "NET::ERR_CERT_COMMON_NAME_INVALID" error with the following cert. Notably, https://www.google.de or any other regional variants work fine.

Unfortunately I am not able to reissue this certificate as suggested for obvious reasons.

My Web proxy configuration is identical to Neil Wilkinson .

Any further suggestions would be appreciated.

Further investigation showed an outdated DHCP Relay config.
Disabling ipv6 and correcting old DNS server entries on the domain controller as well as a reboot resolved the issue thereafter.

Presumably a gateway/router reboot without booting the domain controller caused a conflict.