Custom Certificate Authority for HTTPS scanning

Check your Intermediate CA certificate and Root CA certificate extensions. I have found XG to be strict about it.

Look at a snippet from my config:

[ v3_ca ]
basicConstraints = critical,CA:TRUE
subjectKeyIdentifier = hash
keyUsage = critical,keyCertSign,cRLSign

[ v3_server ]
basicConstraints = CA:FALSE
keyUsage = critical,keyEncipherment
extendedKeyUsage = serverAuth
nsCertType = server
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
authorityInfoAccess = caIssuers;URI:hostname.domain.tld/ca.crt
crlDistributionPoints = URI:hostname.domain.tld/ca.crl

I haven't tried Intermediate CA though. I can do it in spare time.

Thanks for the reply. I just checked the configuration file I'm using, and the Intermediate CA is quite similar to your Root; there are some minor differences though.

I won't be on-site for the next two weeks to dig deeper into this, but I'll check it once I get back and post my findings here.

nsCertType was depreciated years ago and should not be utilized (same goes for the previous 3 EKU/oids for IPsec).  EKU ServerAuth is the EKU/oid that should be utilized.

Unless Sophos changed this in XG from UTM, Sophos does not accept the usage of Intermediate CAs.  I know with 100% certainty Sophos does not accept Intermediate CA and certs for VPN usage, as it prevents the router from authenticating the client.  

• Someone with more experience than I will need to confirm whether or not Intermediate CAs and certs are allowed for the Proxy, as although I tried XG, until all features of UTM are ported over, it was more of a hinderance.

In the meantime, please post your Openssl.cnf.