Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Replies 1 reply
  • Subscribers 39 subscribers
  • Views 234 views
  • Users 0 members are here
Options
Suggested

Blocked page certificate behavior (IOS vs Windows)

Aaron Gillmore

Returned to Sophos after coming from Untangle and have a question regarding the Block page that is shown to clients where content is restricted by the Web Filter, ie Adult content etc.

- I have a LetsEncrypt Certificate correctly set up and using that internally resolvable FQDN to access the firewall web console.  Tested working fine and trusted on all devices.

- Adminstration -> Admin and user Settings : "When redirecting users...." is set to "different hostname" and is set to the same FQDN I use above and as per the LetsEncrypt certificate.

On my windows PC's, when I browse to a website that is blocked by a web category, i'm redirected to the FQDN above and correctly see the blocked page without any certificate warnings.

On my IOS devices when attempting the same as above via the same firewall rule and web filter policy they are blocked however receive a certificate warning and the certificate that is presented is the Firewalls original SecurityAppliance certificate, not the LetsEncrypt certificate?

I am trying to understand why the difference in behavior when using the same rules/filters?  My goal is to have IOS devices redirected to the block page however have the LetsEncrypt certificate used instead because that is trusted by all devices without me having to push to devices manually.  When visitors etc come to my house and use my WiFi, I know they will all most likely natively trust the LetsEncrypt cert so rather that be used so they see the blocked page without manual intervention.

I hope I've explained that ok and maybe i'm missing something obvious?

Thanks!



Added TAGs
[edited by: Erick Jan at 2:04 AM (GMT -8) on 30 Dec 2024]
Parents
  • +1

    Read  Sophos Firewall: HTTPS Decrypt and Scan FAQ


    I assume you are using DPI mode.

    There are two issues:

    Lets say you want to block poker.com

    Browser goes to HTTP poker.com.  Sophos redirects you to HTTPS myxg that presents the LetsEncrypt certificate for myxg.

    Browser goes to HTTPS poker.com.  If order for Sophos to redirects you it need to decrypt the HTTPS so that it can insert its own content.  It uses the configured Scanning Certificate Authority to create a fake certificate for poker.com on the fly.  If the browser trusts certificates creates by that CA, then it accepts the connection.  It get the redirection and is sent to HTTPS myxg that presents the LetsEncrypt certificate for myxg.

    Most likely your Windows computers have the CA installed and IOS does not.  Or your test on Windows is HTTP and test in IOS is HTTPS.

    You can configure that blocks should drop rather than decrypt in Web > General Settings.






Reply
  • +1

    Read  Sophos Firewall: HTTPS Decrypt and Scan FAQ


    I assume you are using DPI mode.

    There are two issues:

    Lets say you want to block poker.com

    Browser goes to HTTP poker.com.  Sophos redirects you to HTTPS myxg that presents the LetsEncrypt certificate for myxg.

    Browser goes to HTTPS poker.com.  If order for Sophos to redirects you it need to decrypt the HTTPS so that it can insert its own content.  It uses the configured Scanning Certificate Authority to create a fake certificate for poker.com on the fly.  If the browser trusts certificates creates by that CA, then it accepts the connection.  It get the redirection and is sent to HTTPS myxg that presents the LetsEncrypt certificate for myxg.

    Most likely your Windows computers have the CA installed and IOS does not.  Or your test on Windows is HTTP and test in IOS is HTTPS.

    You can configure that blocks should drop rather than decrypt in Web > General Settings.






Children
No Data
Unfiltered HTML