This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM User Portal Certificate Warning

Hello,
I get the certificate error message when I open the User Portal (UTM 9.705): NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM

The certificate is imported in on the computer account in Trusted Root Certificate Authorities.
Is there any solution for this?

RalBlo

This thread was automatically locked due to age.

0 FormerMember over 3 years ago

Hi RalBlo,

Thank you for reaching out to the Community!

Are you trying to access the user portal from the external or internal network?

Is it the same certificate as WebAdmin, or did you upload the third-party signed certificate to use for User Portal?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 RalBlo over 3 years ago in reply to FormerMember

I connect from the internal network and the certificate is the internal webadmin certificate.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to RalBlo

Hi RalBlo,

Are you getting the same certificate error in all the browsers? Have you tried to use other browsers?

If you're using Firefox, try to import the certificate on the browser.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 RalBlo over 3 years ago in reply to FormerMember

Firefox reports the error code: SEC_ERROR_UNKNOWN_ISSUER
In Firefox, the certificate was imported under "Your certificates".

Google Chrome, on a Windows 10 PC, reports: NET::ERR_CERT_AUTHORITY_INVALID
Microsoft Edge meanwhile says: NET::ERR_CERT_COMMON_NAME_INVALID
Chrome and Edge are using the Windows 10 certificate store.
Cancel
Vote Up 0 Vote Down

Cancel
0 Steve Weißflog over 3 years ago in reply to RalBlo

Your webadmin cert use a FQDN / the correct FQDN of the UTM e.g. sophos.domain.local?

DNS sophos.domain.local points to the internal IP of the Sophos UTM?

In browser you try to connect to https://sophos.domain.local (if you use https/443 Port for User Portal)

regards
Cancel
Vote Up 0 Vote Down

Cancel
0 RalBlo over 3 years ago

I probably figured out why we are getting this NET::ERR_CERT_WEAK_SIGNATURE_ALGORITH error message. The certificates that the UTM issues are issued to SHA1, but it seems that the complete certification chain must be issued to SHA256.
Where can I change this in the UTM?
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to RalBlo

Hi RalBlo,

Thank you for the update.

Run the following command from your UTM as a root to find out WebAdmin certificate details: cc get_object REF_CaSigWebadminCa

Can you provide the screenshot of the error message? Did you import the certificate from the Management > WebAdmin Settings > HTTPS Certificate?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 RalBlo over 3 years ago in reply to FormerMember

The output of the cc get_object REF_CaSigWebadminCa says among other things: Signature Algorithm: sha1WithRSAEncryption.
The certificate has been imported years ago by an external service, but should have been via Management > WebAdmin Settings > HTTPS Certificate.

Here is the screenshot.
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 3 years ago in reply to RalBlo

you should import a new, trusted certificate from your domain ca.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up 0 Vote Down

Cancel
0 RalBlo over 3 years ago in reply to dirkkotte

You mean from our own Windows CA?
Cancel
Vote Up 0 Vote Down

Cancel