WEB Protection certificate expired message for lets encrypt certificates

Yea a ton of websites are now not accessible due to the DST Root CA X3 expiring today.   Tried disabling as you did and even loading the whole chain into local verification but no luck.

This was suggested in the German forum by user nfawcett:

What is really funny I got a text from Sophos about and hour ago that has a link to their explanation of what is going on...  It is hosted on a site that uses the expired root certificate....

I should say the short URL was.  Here is the Sophos link support.sophos.com/.../KB-000042993

Turn off the following CA from Web Protection, Filtering Options, HTTPS CAs:

• Digital Signature Trust Co. DST Root CA X3

Restart the httpproxy service.

• SSH to the UTM
• sudo su
• /var/mdw/scripts/httpproxy restart

(or just reboot the UTM)

Seemed to do the trick for us.

Yep that fixed it.  Also just cycling "Web Filtering Status" restarted the httpproxy service.

Ah, cool - wasn't sure if that would restart the service or not.  Got out the big hammer.

Thank you very much!

Users go wild on this one: "...but from my private Computer/Mobile phone the site works..." 

solved it for us....

Found an easy fix for this (Thanks AlexRomp and others)

1. If you see the Digital Signature Trust Co. DST Root CA X3 certificate (Web Protection -> Filtering Options -> HTTPS CAs) disable it

2. Turn off and back on the "Web Filtering status" button under Web Protection -> Web Filtering.  

Now after 30 seconds SSL Filtering will back up and everything will start working again