This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Version 9.508 - report on experience

Version 9.508 is released:

https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-508-released

Maybe we could collect some reports about problems or hopefully no problems. Maybe please tell us about the modules (Network, Web, WAF, Mail, WLAN..) you use if you successful updated to 9.508.

Best
Alex

P.S. With the production system, I'll wait a little bit ;-)



This thread was automatically locked due to age.
Parents Reply Children
  • Hey Thorsten,

    which client do you use to check the signature, Outlook?

    Best

    Alex

    -

  • Thorsten, if you follow the KB article that MBP posted above, deleting and regenerating your S/MIME cert on the 'Internal Users' tab of 'Encryption', does this error still appear after you've sent a signed or encrypted email?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • It doesn't matter which email client (Thunderbird, Outlook...) I had already completely reset the CA and re-configured the certificates. The error still exists. I have a SMTP dump for analysis. I'm still waiting for an answer from the support.

  • Unfortunately I can confirm, that a even with a V9.508 CA created and signed message will lead to an error at the recipient site.

     

    Markus

  • What error does the recipient see, Markus - a picture, maybe?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • If the recipient uses f.e. thunderbird he will get:

     

     

    Some recipient bounce our mails and return: the digital signature is invalid.

     

    To be clear: email encryption does not work for us since updating to V9.508!  That's awful. We have about 450 email encryption users an use sophos generated certificates.

    On a 2nd utm whith V9.508 I tested to reset email encryption, created a new ca and created a new user. -> Same error.

     

    In my opinion the statement in kb 131727 is wrong:  "Note: You do not have to regenerate the certs to get S/MIME working. The new engine will work fine without deleting and regenerating certificates. Correcting the SHA1 vulnerability requires certificate regeneration, which will require the users to be deleted and re-added"

     

    Markus

     

     

  • I have revoked my S/Mime and applied again with stonger key. Then I set it up in the email encryption. The error still exists. The signature is invalid for the recipient. I´m still waiting for an answer from the support.

  • Hi Thorsten,

    same here on our UTM, we did recreate most users, outgoing signed messages still get bounced. On one user i saw that the certificate was not recreated, i had to delete the user stop/start encryption, regenerate the user so a new cert was created.

    Any news from Sophos support?

    best regards / Viele Grüße,

    Christian

  • I did some more tests to see if umlauts or special characters are causing the problem. Furthermore I have made various settings like deactivating the scan of outgoing emails and so on. But the problem could not be solved in this way. I'm still waiting for a response from support.

  • Hi Thorsten,

    we also checked for umlauts etc. - does not seem to be the problem.

    Some external partners notified us that they maybe had stored old certificates from our users which may cause this problem. E.g. Barracuda Antispam solutions also seem to store certificate information. They deleted the old ones, we are testing at the moment.

    We contacted Sophos support but did not get any help on this bug, we were told to contact our reseller on this...

    Best regards

    Christian