Issue with IOS 13 & MAC OS 10.15 SSL Certificate Requirements for Transparent proxy

Hi Rax Ramjam 

This issue is already identified by our team and they're working for a fix of the issue in UTM 9. I will update here as soon as there's more information available.

Hi Jaydeep,

Thanks for the response and confirmation that this will also be addressed for UTM 9.

Many thanks,

Rax

Hi Rax Ramjam 

This has been taken care in the latest release of UTM 9 version 9.700. Please read the release notes here https://community.sophos.com/products/unified-threat-management/b/blog/posts/utm-up2date-9-700-released and check for NUTM-11202.

I just updated to 9.700-5 and regenerated my HTTP signing CA and am still having an issue.  The regenerated signing CA is producing a 1024 key and MAC 10.15 and IOS 13 both require at least 2048.  Is there a way to regen my HTTP CA to produce a 2048 key which I believe would solve the issue.  

The error I am getting from the web page is "NET::ERR_CERT_WEAK_KEY"

Thanks

I was able to resolve this myself by creating a CA using the Mac 10.15 Keychain Access/Certificate Assistance app and created a 2048 CA.  I then uploaded the .P12 into the UTM Filtering WebProtection/Filtering Options/HTTP CA tab and then downloaded the cert to my IOS13 and all tested out correct.  Also works with my Mac 10.15 just make sure you trust the cert on both 10.15 and IOS 13.

I am also running into this issue with iOS 13 devices not accepting the 1024bit signing CA generated by the UTM. I have now updated to 9.7-5 and regenerated the signing CA, but note that the generated cert is still 1024 bits which does not conform to Apple's requirements. I have not yet been successful with the workaround suggested by Duane.

--Larry

Larry, I ran the CA signing cert process from my Mac Catalina and it defaulted to creating a 2048 key.  Just do a search on "how to generate a 2048 signing cert" for your specific OS and then import into the UTM under "Web Protection/Filtering Options/HTTPS CAs/Signing CA".  Don't hit the "Regenerate" under "Signing CA" as it will default to a 1024 key.  Make sure to upload the new one you just created.

Hi Duane and welcome to the UTM Community!

First participation is providing a solution - cool!

Cheers - Bob

When will this be fixed on the UTM?  I'm not eager to hack this together myself.  Is there a patch coming that will result in the Regenerate button doing what it should - generating an appropriate 2048 bit key?  The hack is not a fix.

Hi,

I agree: creating an external CA certificate is not the solution since it has to work out of the box! We recently upgraded our firewall (exact for that reason, iOS devices can't access the internet) and have the same issue with hundreds of devices.

Our goal was to solve this problem, not to manually create another certificate.

Hi,

I agree: creating an external CA certificate is not the solution since it has to work out of the box! We recently upgraded our firewall (exact for that reason, iOS devices can't access the internet) and have the same issue with hundreds of devices.

Our goal was to solve this problem, not to manually create another certificate.

Guys, please get cases open with Sophos Support.  This is supposed to work in 9.7.

Cheers - Bob

Hi,

is there any news here? Something to do with the settings in the UTM or a Bug?

Cheers

It looks like a bug.

I update to 9.7 and regenerated the certificate and have the same issue.

I have logged a ticket with Sophos and am awaiting a response.

Did you check, if the certificate actually mets all apple requirements?

Download the PEM and open it to verify, if everything is in place.

https://support.apple.com/en-gb/HT210176

Yes i checked. it doesn't meet the requirements. the keysize is 1024 when i click regenerate in the utm console. This is the issue.

i followed the suggestion above by Duane Clouse and manually generated a certificate to resolve the issue. This is a pain though. It would be nice to be able to click the button in the UTM and for it to work.

Me too  it is 1024bit, not the supposed 2048bit.

Tested with the XG - here it works...