proxy ca cert expire alert ?

There have been other threads about this, Colin.  It's the CA used in Web Filtering to allow the Proxy to scan HTTPS traffic.  If you haven't distributed the Proxy CA to your users, just [Regenerate] one on the 'HTTPS CAs' tab of 'Filtering Options'.  You will need to distribute the new CA to any device that uses the old one.

Cheers - Bob

We dont use the web filtering option so why is this happening ?

Do we need to enable but not use to allow regen option to be selected ?

Those are good questions for Sophos Support - please let us know what they say.

Cheers - Bob

enabled web filtering and regenerated proxy ca, need to check no alerts over next few days.

if fixes will disable web filtering

enabled web filtering and regenerated proxy ca, need to check no alerts over next few days.

if fixes will disable web filtering

I know it's been 2+ years, but did this work? I have a similar situation. I'm getting emails the Proxy CA is going to expire, but from what I can tell Web Filtering is not even turned on. (I inherited this unit, so thanks in advance for any reply.)

Hi Jerry and welcome to the UTM Community!

The only way I know to address this is with a short-term demo license that lets me turn Web Filtering on to be able to generate a new CA - maybe your reseller can help with that.  Maybe Sophos Support has a better trick.

Cheers - Bob

Hello Jerry,

Thank you for contacting the Sophos Community.

Please check this KB to confirm if the certificate in question is the one that will expire.

If you don't use that certificate you can ignore the alert, you can turn it off by going to Management >> Notifications >> and untick this 2.

Additionally, I could provide you with a temporary license if you would like, with Network Protection so you can regenerate the certificate, if you want this, please send me a PM.

Regards,

Oops!  I know you know this, Emmanuel, but it's the Web Filtering Proxy CA, so he would need a license that enables Web Protection.

Jerry, you can use Emmanuel's trick to solve your immediate problem, but you won't want to leave WARN-600 unchecked after you solve the Proxy CA expiration problem.

Cheers - Bob