Quarantine Report uses HTTP links instead of HTTPS

To clarify...

I'm not seeing this.  Quarantine reports use https in 9.510-5.  That's why I suspect that you have a unique situation that Support should look at.

Cheers - Bob

Thank you Bob,

I will contact support on Monday and post back the results.

Same problem here with two different customer UTMs.
Opened support tickets too.

Regards
Sebastian

Hi,

can you please check in the Quarantine Report if the Release /Whitelist Links starts with https:// ?

Maybe the users clicked on an Quarantine Report generated with 9.509 ?

Source code of HTML mail

<a style='font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px;' color='#000000' class='linkRelease' href="http://abc.de:3840/release.plc?proto=smtp&amp;cluster_id=2&amp;message_id=1fpgXo-0005QS-3F&amp;size=22162&amp;whitelist=0">Freigeben</a>

No user caused problem.

PeterRenchen said:

Maybe the users clicked on an Quarantine Report generated with 9.509 ?

You´re right - the reports from before the update have http-links, that are not working anymore. New reports have https-links, that are working.

Thanks :-)

I can confirm, the quarantine reports in both older version and in 9.510-5 still have http links, and there is no difference for the users whether they click on the older version's report, or generated by 9.510-5, they still get the same message from the browser posted earlier.

I had the same behaviour here, too.

After disable / enable "Quarantine Report status" in Email Protection - Quarantine Report, and after changing the from IP-Adress to Hostname in the Advanced Tab my firewall is now sending emails with https-links inside. Not sure if both actions are necessary.

Hope this helps you too.

Regards Heinrich

Thank you Heinrich for sharing, but it did not work for me unfortunately.

I did it two times:
1. Disabled and re-enabled the quarantine report without Hostname change.
2. Same WITH hosname change

For each of these scenarios, changed the schedule when quarantine report delivered and sent myself a spam email. The links still use HTTP...

Thank you anyway.

Someone with the problem neefs to get this edcalayed with Sophos support.

This morning, Aug 20th, I opened the case with Sophos.

Will post the results.

Same problem here checked 5 on machines.

The problem exists also by using new reports. the link is a http not a https link. Already inserted a hostname in advanced option of quarantine report. After inserting hostname i stopped quarantine report and the restarted the report. send a "please buy viagra" :-) mail and wait for the next report: no change - no https link.

Does anyone know what else could help?

Thanks and regards

Siegfried

Same problem here checked 5 on machines.

The problem exists also by using new reports. the link is a http not a https link. Already inserted a hostname in advanced option of quarantine report. After inserting hostname i stopped quarantine report and the restarted the report. send a "please buy viagra" :-) mail and wait for the next report: no change - no https link.

Does anyone know what else could help?

Thanks and regards

Siegfried

…. finally restarted the box and sending mail to a new created pop account "test@...". Same result: URL starts with http

Siegfried

OK, I have the same problem and maybe an important hint.

I just found out the following:

If I receive SPAM in a POP3-Quarantine, the link is wrong (http)

If I receive SPAM via SMTP, the link works correctly (https)

Maybe that's why SOPHOS can't find the problem, because they test SMTP and not POP3?

Thank you Michael,

This is very interesting comment. I just forwarded it to Sophos. Will post their feedback if any.