Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
Options
Suggested

Sophos Firewall Web protection (and other) features went down due to no comm with license server

Shadow82

Hi!

Recently I started to have issues with my Web servers guarded by Sophos Firewall v.21.

FW has 2 web servers configured with "Protect with web server protection" + "web server" rules. When client reuests for connection, FW started to RST at TCP hanshake

I got into this and noticed that my Web server license subscription has been deactivated

Trying to synchronize it doesn't work.

My licensing log shows that since I upgraded FW to v.21

ERROR Dec 04 20:35:38Z [4148057856]: licensing_do_licensecheck() : send post failed.
INFO Dec 04 20:35:38Z [4147791616]: --requestType = 8
INFO Dec 04 20:35:38Z [4147791616]: --serial = VDoesnt_matter9
INFO Dec 04 20:35:38Z [4147791616]: --fwversion = 21.0.0.169
INFO Dec 04 20:35:38Z [4147791616]: --cert = /content/licensing/lic_csr.pem
INFO Dec 04 20:35:38Z [4147791616]: --key = /content/licensing/lic_csr.key
INFO Dec 04 20:35:38Z [4147791616]: --token = Token-Id:VDoesnt_matter9
INFO Dec 04 20:35:38Z [4147791616]: URL : eu-prod-utm.soa.sophos.com/.../appliance
INFO Dec 04 20:35:38Z [4147791616]: licensing_do_applianceupdate : request : { "serialNumber": "VDoesnt_matter9", "applianceAttributes": [ { "name": "firmwareVersion", "value": "21.0.0.169" } ] }
ERROR Dec 04 20:35:38Z [4147791616]: curl_easy_perform(60) failed: SSL peer certificate or SSH remote key was not OK
ERROR Dec 04 20:35:38Z [4147791616]: licensing_do_applianceupdate() : Problem in contacting Server

Here full log:

Fullscreen
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
SFVH_VM01_SFOS 21.0.0 GA-Build169# cat licensing.log
INFO Sep 26 12:00:11Z [4147586816]: --requestType = 1
INFO Sep 26 12:00:11Z [4147586816]: --serial = VDoesnt_matter9
INFO Sep 26 12:00:11Z [4147586816]: --deviceid = 34278023-80e0-4469-849f-e65ba54b5057
INFO Sep 26 12:00:11Z [4147586816]: --model = SF01V
INFO Sep 26 12:00:11Z [4147586816]: --vendor = VM01
INFO Sep 26 12:00:11Z [4147586816]: --upgradedFrom = 0
INFO Sep 26 12:00:11Z [4147586816]: --fwversion = 20.0.2.378
INFO Sep 26 12:00:11Z [4147586816]: --cert = /_conf/certificate/licensing/mfgr_vendor_VM.pem
INFO Sep 26 12:00:11Z [4147586816]: --token = Token-Id:SO-D5C052A8
INFO Sep 26 12:00:11Z [4147586816]: --key = /_conf/certificate/licensing/mfgr_vendor_VM.key
INFO Sep 26 12:00:11Z [4147586816]: URL : https://eu-prod-utm.soa.sophos.com/api/device/1/applianceactivation
INFO Sep 26 12:00:11Z [4147586816]: request : { "serialNumber": "VDoesnt_matter9", "deviceId": "34278023-80e0-4469-849f-e65ba54b5057", "model": "SF01V", "deviceFirmwareVersion": "20.0.2.378", "vendorCode": "VM01" }
INFO Sep 26 12:00:12Z [4147586816]: response : {"trackingId":"b597ed29-3f0a-4dbd-8a22-34825c1a790d","statusCode":200,"errorCode":"ITSERVICELAYER_SUCCESS","message":"Activation successful.","data":{"serialNumber":"VDoesnt_matter9","deviceId":"34278023-80e0-4469-849f-e65ba54b5057","model":"SF01V"}}
INFO Sep 26 12:00:12Z [4147586816]: Activation Successfull...:)
####################################################
generate certificate signing request (CSR) Thu Sep 26 13:00:13 BST 2024
Thu Sep 26 13:00:14 BST 2024 certificate signing request generated with status :: 0
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Any ideas?



Edited TAGs
[edited by: Erick Jan at 11:30 PM (GMT -8) on 4 Mar 2025]
  • 0

    Is something between Firewall and the internet? Your error indicates, the Firewall is not accepting the certificate presented. 

    __________________________________________________________________________________________________________________

    • 0 in reply to LuCar Toni

      Nothing except home router that provides Internet access.

      VMs behind that FW do have Internet access as my whole LAN

      I noticed this in Sophos Central section:

      • 0 in reply to Shadow82

        Can you go to the Shell and try: 

        openssl s_client -showcerts -connect eu-prod-utm.soa.sophos.com:443

        You should see something: 
        CONNECTED(00000003)
        depth=2 OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
        verify return:1
        depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018
        verify return:1
        depth=0 C = GB, ST = Oxfordshire, L = Abingdon, O = SOPHOS LIMITED, CN = *.soa.sophos.com
        verify return:1
        ---
        Certificate chain
        0 s:C = GB, ST = Oxfordshire, L = Abingdon, O = SOPHOS LIMITED, CN = *.soa.sophos.com
        i:C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018

        __________________________________________________________________________________________________________________

        • 0 in reply to LuCar Toni

          Looks good

          Fullscreen
          1
          2
          3
          4
          5
          6
          7
          8
          9
          10
          11
          12
          13
          14
          15
          16
          17
          18
          19
          20
          21
          SFVH_VM01_SFOS 21.0.0 GA-Build169# openssl s_client -showcerts -connect eu-prod-utm.soa.sophos.com:443
          CONNECTED(00000003)
          depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018
          verify error:num=20:unable to get local issuer certificate
          verify return:1
          depth=0 C = GB, ST = Oxfordshire, L = Abingdon, O = SOPHOS LIMITED, CN = *.soa.sophos.com
          verify return:1
          ---
          Certificate chain
          0 s:C = GB, ST = Oxfordshire, L = Abingdon, O = SOPHOS LIMITED, CN = *.soa.sophos.com
          i:C = BE, O = GlobalSign nv-sa, CN = GlobalSign RSA OV SSL CA 2018
          -----BEGIN CERTIFICATE-----
          MIIGszCCBZugAwIBAgIMaxgxvCM3edxni+aeMA0GCSqGSIb3DQEBCwUAMFAxCzAJ
          BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSYwJAYDVQQDEx1H
          bG9iYWxTaWduIFJTQSBPViBTU0wgQ0EgMjAxODAeFw0yNDAzMjAxMDI2MDVaFw0y
          NTA0MjExMDI2MDRaMGoxCzAJBgNVBAYTAkdCMRQwEgYDVQQIEwtPeGZvcmRzaGly
          ZTERMA8GA1UEBxMIQWJpbmdkb24xFzAVBgNVBAoTDlNPUEhPUyBMSU1JVEVEMRkw
          FwYDVQQDDBAqLnNvYS5zb3Bob3MuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
          MIIBCgKCAQEAqbJqBXwXqZitDBRMsTk9mhuRFFAJf8kCtPctiZaHewumF8Sbl/lm
          J27o26MSYktaVS6A5//uT8U6uQH37Ykm1QMi/JxRVTRja0LOzzvnu1N+1BSWjQjc
          XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

          How about this?

          Security Heartbeat requires a subscription. It can be configured but cannot be enforced without a valid Network Protection subscription.
          Security Heartbeat requires a valid Intercept X license on Sophos Central. Synchronized Application Control requires Security Heartbeat to be turned on
          • 0 in reply to Shadow82

            Could you send me the Support Access ID of this firewall? 

            __________________________________________________________________________________________________________________

            • 0 in reply to LuCar Toni

              Thanks for your interest. I've sent you private message with Support Access ID

              • 0 in reply to Shadow82

                Any reason, you deleted all those CAs in December? 
                Thats the reason, you are getting this error:  verify return code: 20 (unable to get local issuer certificate)

                Without this CA, you will run into problems: https://support.globalsign.com/ca-certificates/root-certificates/globalsign-root-certificates 

                __________________________________________________________________________________________________________________

                • 0 in reply to LuCar Toni

                  Yes - I've had problem in the past with upgrading the FW to v.21 and you suggested to delete all CAs and try to upgrade again.

                  https://www.reddit.com/r/sophos/comments/1h6fr2z/sophos_firewall_upgrade_to_v21_fails/

                  That helped with that problem, but did it emerged a new one? :-)

                  But I'm cheeky here by pointing this out :-)

                  So - is there some option to download necessary CAs or should I install them one by oneby hand?

                  • 0 in reply to Shadow82

                    I was refering to the CAs for Lets Encrypt, you deleted "all" CAs. 

                    __________________________________________________________________________________________________________________

                    • 0 in reply to LuCar Toni

                      Sh... you're right. I cleansweped too much :/

                      Should I install back all CAs one by one?

                      • +1 in reply to Shadow82

                        You could try to install the linked above and then see, if you can sync the license. 

                        __________________________________________________________________________________________________________________

                        • 0 in reply to LuCar Toni

                          Installed those 19 CAs (as validation only), rebooted the FW and the issue persists

                          Most fresh logs

                          INFO Mar 04 20:22:43Z [4147730176]: --requestType = 2
                          INFO Mar 04 20:22:43Z [4147730176]: --lastCheckCode = 00000000-0000-0000-0000-000000000002
                          INFO Mar 04 20:22:43Z [4147730176]: --cert = /content/licensing/lic_csr.pem
                          INFO Mar 04 20:22:43Z [4147730176]: --token = Token-Id:V0100123RK82F59
                          INFO Mar 04 20:22:43Z [4147730176]: --key = /content/licensing/lic_csr.key
                          INFO Mar 04 20:22:43Z [4147730176]: URL : eu-prod-utm.soa.sophos.com/.../license
                          ERROR Mar 04 20:22:43Z [4147730176]: curl_easy_perform(60) failed: SSL peer certificate or SSH remote key was not OK
                          ERROR Mar 04 20:22:43Z [4147730176]: licensing_do_licensecheck() : send post failed.

                      Unfiltered HTML
                      x An error occurred. Please try again or contact your administrator.