Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 39 subscribers
  • Views 321 views
  • Users 0 members are here
Options
Suggested

Blocked page certificate behavior (IOS vs Windows)

Aaron Gillmore

Returned to Sophos after coming from Untangle and have a question regarding the Block page that is shown to clients where content is restricted by the Web Filter, ie Adult content etc.

- I have a LetsEncrypt Certificate correctly set up and using that internally resolvable FQDN to access the firewall web console.  Tested working fine and trusted on all devices.

- Adminstration -> Admin and user Settings : "When redirecting users...." is set to "different hostname" and is set to the same FQDN I use above and as per the LetsEncrypt certificate.

On my windows PC's, when I browse to a website that is blocked by a web category, i'm redirected to the FQDN above and correctly see the blocked page without any certificate warnings.

On my IOS devices when attempting the same as above via the same firewall rule and web filter policy they are blocked however receive a certificate warning and the certificate that is presented is the Firewalls original SecurityAppliance certificate, not the LetsEncrypt certificate?

I am trying to understand why the difference in behavior when using the same rules/filters?  My goal is to have IOS devices redirected to the block page however have the LetsEncrypt certificate used instead because that is trusted by all devices without me having to push to devices manually.  When visitors etc come to my house and use my WiFi, I know they will all most likely natively trust the LetsEncrypt cert so rather that be used so they see the blocked page without manual intervention.

I hope I've explained that ok and maybe i'm missing something obvious?

Thanks!



Added TAGs
[edited by: Erick Jan at 2:04 AM (GMT -8) on 30 Dec 2024]
Parents
  • +1

    Read  Sophos Firewall: HTTPS Decrypt and Scan FAQ


    I assume you are using DPI mode.

    There are two issues:

    Lets say you want to block poker.com

    Browser goes to HTTP poker.com.  Sophos redirects you to HTTPS myxg that presents the LetsEncrypt certificate for myxg.

    Browser goes to HTTPS poker.com.  If order for Sophos to redirects you it need to decrypt the HTTPS so that it can insert its own content.  It uses the configured Scanning Certificate Authority to create a fake certificate for poker.com on the fly.  If the browser trusts certificates creates by that CA, then it accepts the connection.  It get the redirection and is sent to HTTPS myxg that presents the LetsEncrypt certificate for myxg.

    Most likely your Windows computers have the CA installed and IOS does not.  Or your test on Windows is HTTP and test in IOS is HTTPS.

    You can configure that blocks should drop rather than decrypt in Web > General Settings.






  • 0 in reply to Michael Dunn

    Thanks Michael, i'm familiar with HTTPS decryption as I work in this industry however i'm not using DPI, at least not to my knowledge on the Sophos.

    On the firewall rule, I do have "Scan HTTP and decrypted HTTPS" which I believe shouldn't be altering any HTTPS packets.

    On the SSL/TLS inspection rules page, I have not added any new rules and the default rule set to Don't Decrypt is still there.

    I was just puzzled as to why the different behavior on Windows devices vs IOS devices.  To be clear, i've not installed any certificates on any machines, windows or IOS including the Firewalls Self signed cert.  I'm relying on the built in browsers on both platforms which do already trust LetsEncrypt certificates as they already have that trust built in.  

    Why on windows devices using the exact same rules and policies as the IOS devices does the block page use the LetsEncrypt certificate however when I attempt to browse to the same page on an IOS device it tries to show the blocked page but is using the Firewalls Self Signed cert, not the LetsEncrypt cert like it did with Windows?

    Thanks again!

Reply
  • 0 in reply to Michael Dunn

    Thanks Michael, i'm familiar with HTTPS decryption as I work in this industry however i'm not using DPI, at least not to my knowledge on the Sophos.

    On the firewall rule, I do have "Scan HTTP and decrypted HTTPS" which I believe shouldn't be altering any HTTPS packets.

    On the SSL/TLS inspection rules page, I have not added any new rules and the default rule set to Don't Decrypt is still there.

    I was just puzzled as to why the different behavior on Windows devices vs IOS devices.  To be clear, i've not installed any certificates on any machines, windows or IOS including the Firewalls Self signed cert.  I'm relying on the built in browsers on both platforms which do already trust LetsEncrypt certificates as they already have that trust built in.  

    Why on windows devices using the exact same rules and policies as the IOS devices does the block page use the LetsEncrypt certificate however when I attempt to browse to the same page on an IOS device it tries to show the blocked page but is using the Firewalls Self Signed cert, not the LetsEncrypt cert like it did with Windows?

    Thanks again!

Children
  • 0 in reply to Aaron Gillmore

    In the firewall rule is "use proxy instead of dpi mode" selected?

    What appears in the address bar on the windows computer vs ios device?

    Is the website you are visiting HTTP or HTTPS?

    Here is an example why things COULD be different, not saying this is the reason.

    Browser 1 (Windows):
    Type in "example.com" in the address bar. The browser makes a request to HTTP example.com which immediately does a redirect to HTTPS example.com.  The user sees an HTTPS page.

    Browser 2 (ios):
    Type in "example.com" in the address bar. The browser makes a request to HTTPS example.com.  The user sees an HTTPS page.

    Now if Sophos Firewall were to block, in Browser 1 it is actually blocking HTTP while Browser 2 is blocking HTTPS.  Different behaviour.  The devil is in the details.  If you really want to know, you need to be looking at debug log files, or F12 Network request, or tcpdump.  Find out what the actual requests are.

    Sophos Firewall is not changing behaviour based on Windows or IOS.  It is that different client behave differently.

Unfiltered HTML