Web proxy reporting false certificate issues

I have seen this several times today and wonder if it is related to UTM 9.703-3 which I updated to last night (from 9.702-1). If I turn off web filtering and allow the browser to examine the cert it is accepted, and manually looking shows that it is within its valid date range.

--Larry

I don't think it's related to the update.  I'm sure it's related to the way utm handles cross signed certs.  Read the link in my OP above.

So far i've exempted the few sites with issue from ssl trust checking.

Its since a comodo cert expired on 30th May - all the sites with issues use comodo certs.  It's how utm is dealing with this.  We raised a support call yesterday  which is still being investigated

Hi folks,

the answer in the XG forums was to delete the outdated certificates from the UTM.

Ian

Hi,

Can you provide how to do that on Sophos UTM. I am getting tired of bypassing for each site.

Hi,

I am sorry my UTM knowledge s very rusty and I do not have a working UTM at the moment.

You will need to hope BAlfson come along and looks at your request.

Ian

Login to UTM via SSH as loginuser. Then su to root.

cd /etc/ssl/certs

mkdir ../badcerts

sophos01:/etc/ssl/certs # ls -l | grep AddTrust_E
lrwxrwxrwx 1 root root 26 Jan 21 01:31 157753a5.0 -> AddTrust_External_Root.pem
lrwxrwxrwx 1 root root 26 Jan 21 01:31 3c58f906.0 -> AddTrust_External_Root.pem
-rw-r--r-- 1 root root 1574 Jan 21 01:31 AddTrust_External_Root.pem
sophos01:/etc/ssl/certs # mv 157753a5.0 3c58f906.0 AddTrust_External_Root.pem ../badcerts

sophos01:/etc/ssl/certs # /var/mdw/scripts/httpproxy restart
:: Restarting httpproxy
:: Stopping httpproxy done
:: Starting httpproxy done
sophos01:/etc/ssl/certs #

Login to UTM via SSH as loginuser. Then su to root.

cd /etc/ssl/certs

mkdir ../badcerts

sophos01:/etc/ssl/certs # ls -l | grep AddTrust_E
lrwxrwxrwx 1 root root 26 Jan 21 01:31 157753a5.0 -> AddTrust_External_Root.pem
lrwxrwxrwx 1 root root 26 Jan 21 01:31 3c58f906.0 -> AddTrust_External_Root.pem
-rw-r--r-- 1 root root 1574 Jan 21 01:31 AddTrust_External_Root.pem
sophos01:/etc/ssl/certs # mv 157753a5.0 3c58f906.0 AddTrust_External_Root.pem ../badcerts

sophos01:/etc/ssl/certs # /var/mdw/scripts/httpproxy restart
:: Restarting httpproxy
:: Stopping httpproxy done
:: Starting httpproxy done
sophos01:/etc/ssl/certs #

i am not very familiar with terminal. Probably it cant be done in webadmin?

didnt helped:

sophos01:/etc/ssl/certs # mkdir ../badcerts
sophos01:/etc/ssl/certs # ls -l | grep AddTrust_E
lrwxrwxrwx 1 root root 26 Jan 21 07:31 157753a5.0 -> AddTrust_External_Root.pem
lrwxrwxrwx 1 root root 26 Jan 21 07:31 3c58f906.0 -> AddTrust_External_Root.pem
-rw-r--r-- 1 root root 1574 Jan 21 07:31 AddTrust_External_Root.pem
sophos01:/etc/ssl/certs # mv 157753a5.0 3c58f906.0 AddTrust_External_Root.pem ../badcerts
sophos01:/etc/ssl/certs # /var/mdw/scripts/httpproxy restart
:: Restarting httpproxy
:: Stopping httpproxy done
:: Starting httpproxy done

This is an issue we are also experiencing.

UTM 9.702-1 with Web Filtering in Standard/Decrypt and Scan Mode.

I just tried VladRud's solution of moving the AddTrust_External_Root cert and its links to the /etc/ssl/badcerts directory. Rather than just restarting the httpproxy daemon, I rebooted. Initially thought that this solved the problem, but then I realized that I had tested with a site I had already added an exception to... (insert sounds associated with a public admission of stupidity). I have verified that the AddTrust_External_Root cert did not magically reappear in the /etc/ssl/certs directory after the reboot. After removing the exception and retesting, this does not solve the problem with the expired cert.

--Larry

If i understand you correctly restarting http proxy didnt helped but restart whole UTM helped?

Simpler solution that worked for me.  Disable the cert in web protection, filtering options, HTTP CAs.  It was the 5th one down for me.  After disabling, restart the proxy either through command line (see above), or by disabling/enabling the web filtering on the main web filtering page. Change doesn't take effect unless proxy is restarted.

I owe you a beer [B], thanks

I don't know why it didn't occur to me to restart the proxy initially, after making the cert change.   Maybe I thought toggling the cert off would do a restart automatically¿?

Glad it worked and I too can remove a bunch of exceptions from the list.  Maybe Sophos will issue an update soon that removes that cert entirely.

Hi!

This workaround and/or the command lines do not work in my HA cluster environment.

After restarting both nodes the certificate is still listed or listed again.

Disabling the certificate and restarting the proxy has no effect, still getting "Untrusted Website".

Any ideas???

Unfortunately I don't.  I'm not running an HA config, just a single utm in a home environment.  Also, when testing, make sure you're doing a hard refresh (ctrl-f5), otherwise it could be using cached data.

Maybe try taking the slave off line and attempt the changes above.  It's been working properly for me since I disabled that cert.

We really do need a proper solution from Sophos.

Hallo Don,

Of course, for a paid license, the preference should be to get a case open with Sophos Support.

What happens if you do the command line approach on both Slave and Master before you restart the proxy?

To connect to the Slave,

ha_utils ssh

You will need to know both the loginuser and root passwords to login to the Slave.

Cheers - Bob