Thread Info
  • State Verified Answer
  • +11 person also asked this people also asked this
  • Locked Locked
  • Replies 36 replies
  • Answers 4 answers
  • Subscribers 26 subscribers
  • Views 665324 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPS scanning Web Protection SSL error ERR_CERT_COMMON_NAME_INVALID

KarstenStolten

Hi

After Google has updated Chrome, we now have problems accessing websites with SSL.

HTTPS Scanning is enabled on the Sophos UTM and the problem seems to be that Chrome no longer accepts an empty DNS name in the SSL certificate presented in the browser.

Does anyone have a solution to this?

I guess that the best solution would be for Sophos to change the way they generate the "Man in the middle" certificate so that the website URL is listed in the DNS (or SAN) in the certificate.

Anyone?

Kind regards

Karsten Stolten



This thread was automatically locked due to age.
Parents
  • +1

    HI KarstenStolten, 

    The new version of Chrome V58 will no longer accept certificates that do not have a subject alternate name.  Chrome is following RFC 2818 for this change.  Chrome V58 has now gone GA .

    This could affect the Sophos Web appliance and Sophos UTM, which both use https scanning. The site generated certificate that we give back in these cases does not have a subject alternate name, meaning Chrome will reject the certificate and block the site

    There are 3 options you may opt for. 

    Option 1: Disable HTTPS scanning untill the issue is fixed. 

    Option 2: Use another Web Browser . 

    Option 3 *preferred: setting this GPO to ENABLED https://www.chromium.org/administrators/policy-list-3#EnableCommonNameFallbackForLocalAnchors 

    Our Dev team are working on this issue should be resolved soon . 

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Aditya Patel

    Hello, I'm just wondering if there is any news on when we might see an update to resolve this issue?

    As this is now starting to affect our organisation as well. We managed to stop the updates before our PCs were affected but a number of our Macs have already updated to Chrome 58 and can not get on Google websites and services.

    Unfortunately Macs cannot use GPOs, so we have had to advise users to switch to Safari for the time being, but it would be better if Sophos could fix the issue with HTTPS certificate generation on their UTM system.

    Thanks,

    Dan Jackson (Lead ITServices Technician)

    Long Road Sixth Form College

    Cambridge, UK.

  • +1 in reply to Long Road SFC ITServices

    Hi All,

    We have resolved this issue with our latest update 

    UTM 9.413004

    ftp://ftp.astaro.de/UTM/v9/up2date/u2d-sys-9.412002-413004.tgz.gpg

    MD5: 753ff750ef6785f3f7fa2c97ed9da42c

    File size: ~4MB

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Aditya Patel

    HI,

     

    I've applied this and it has NOT fixed the issue unfortunately - exactly the same issue with HSTS enabled sites and Chrome 58 as before.

    Disabling SSL inspection is not really a viable option, nor is rolling out a GPO.

     

    Dan

  • 0 in reply to D B

    Surely Sophos have had an idea that this was going to cause a problem?  Google have had this planned for months from what I can see, so how does a company as big as Sophos not patch their products in good time, to resolve any issue?  We shouldn't have to resort to changing group policy settings to implement a workaround.

  • 0 in reply to colly72

    colly72 said:

    Surely Sophos have had an idea that this was going to cause a problem?  Google have had this planned for months from what I can see, so how does a company as big as Sophos not patch their products in good time, to resolve any issue?  We shouldn't have to resort to changing group policy settings to implement a workaround.

     

    To be fair, you can find evidence of this hitting any major filtering provider you care to think of. Its not just Sophos being lazy ;)

  • 0 in reply to sparkeh

    Maybe it's a criticism of the industry as a whole then.  Still doesn't cover Sophos in much glory.

Reply Children
No Data
Unfiltered HTML