Quarantine Report uses HTTP links instead of HTTPS

To clarify...

I'm not seeing this.  Quarantine reports use https in 9.510-5.  That's why I suspect that you have a unique situation that Support should look at.

Cheers - Bob

Thank you Bob,

I will contact support on Monday and post back the results.

Same problem here with two different customer UTMs.
Opened support tickets too.

Regards
Sebastian

Hi,

can you please check in the Quarantine Report if the Release /Whitelist Links starts with https:// ?

Maybe the users clicked on an Quarantine Report generated with 9.509 ?

Source code of HTML mail

<a style='font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px;' color='#000000' class='linkRelease' href="http://abc.de:3840/release.plc?proto=smtp&amp;cluster_id=2&amp;message_id=1fpgXo-0005QS-3F&amp;size=22162&amp;whitelist=0">Freigeben</a>

No user caused problem.

PeterRenchen said:

Maybe the users clicked on an Quarantine Report generated with 9.509 ?

You´re right - the reports from before the update have http-links, that are not working anymore. New reports have https-links, that are working.

Thanks :-)

I can confirm, the quarantine reports in both older version and in 9.510-5 still have http links, and there is no difference for the users whether they click on the older version's report, or generated by 9.510-5, they still get the same message from the browser posted earlier.

I had the same behaviour here, too.

After disable / enable "Quarantine Report status" in Email Protection - Quarantine Report, and after changing the from IP-Adress to Hostname in the Advanced Tab my firewall is now sending emails with https-links inside. Not sure if both actions are necessary.

Hope this helps you too.

Regards Heinrich

Thank you Heinrich for sharing, but it did not work for me unfortunately.

I did it two times:
1. Disabled and re-enabled the quarantine report without Hostname change.
2. Same WITH hosname change

For each of these scenarios, changed the schedule when quarantine report delivered and sent myself a spam email. The links still use HTTP...

Thank you anyway.

Thank you Heinrich for sharing, but it did not work for me unfortunately.

I did it two times:
1. Disabled and re-enabled the quarantine report without Hostname change.
2. Same WITH hosname change

For each of these scenarios, changed the schedule when quarantine report delivered and sent myself a spam email. The links still use HTTP...

Thank you anyway.

Someone with the problem neefs to get this edcalayed with Sophos support.

This morning, Aug 20th, I opened the case with Sophos.

Will post the results.