Web Protection With Subordinate CA

If I understand what you want, have you tried to upload the trusted root CA - on the 'HTTPS CAs' tab?

Cheers - Bob

Yes, the trusted root CA is uploaded to the UTM.  One note, is that I have two, the old and the new one as I re-generated the trusted root certificate with a stronger signature.  I tried disabling the old one as a test but, same result.

So, I decided to follow up on this after some time and came across the following directly from Sophos:

https://community.sophos.com/kb/en-US/115592

Specifically, this:

"If your organization already has an internally trusted certificate authority established and distributed, then using your own CA certificate will remove the need to distribute the public signing cert to your users."

Now, in my above example, I had used a subordinate CA cert that was signed by my root CA but it "should" act in the same way, but doesn't.  The imported PFX file also was created with a PEM file that had the chain in it so the chain wasn't missing.  That brought me to this:

http://ideas.sophos.com/forums/17359-utm-formerly-asg-feature-requests/suggestions/3044210-https-scanning-have-proxy-provide-certificate-cha

The above seems to indicate that this is not possible, yet, contradicts what is provided in the Sophos KB.  Note that the more recent then the feature request mentioned above.

Now, just as a test, I followed this article:

https://social.technet.microsoft.com/Forums/office/en-US/41cf0b1c-a1b1-4d95-bddb-e677b69ed80c/exporting-private-keys?forum=winserversecurity

It notes to export the root CA cert and key and import it into the security device.  I attempted that as a test since the root CA is trusted.  Again.  No dice.

It would be nice if Sophos could clarify if this is/isn't possible and update their documentation appropriately.

So, I decided to follow up on this after some time and came across the following directly from Sophos:

https://community.sophos.com/kb/en-US/115592

Specifically, this:

"If your organization already has an internally trusted certificate authority established and distributed, then using your own CA certificate will remove the need to distribute the public signing cert to your users."

Now, in my above example, I had used a subordinate CA cert that was signed by my root CA but it "should" act in the same way, but doesn't.  The imported PFX file also was created with a PEM file that had the chain in it so the chain wasn't missing.  That brought me to this:

http://ideas.sophos.com/forums/17359-utm-formerly-asg-feature-requests/suggestions/3044210-https-scanning-have-proxy-provide-certificate-cha

The above seems to indicate that this is not possible, yet, contradicts what is provided in the Sophos KB.  Note that the more recent then the feature request mentioned above.

Now, just as a test, I followed this article:

https://social.technet.microsoft.com/Forums/office/en-US/41cf0b1c-a1b1-4d95-bddb-e677b69ed80c/exporting-private-keys?forum=winserversecurity

It notes to export the root CA cert and key and import it into the security device.  I attempted that as a test since the root CA is trusted.  Again.  No dice.

It would be nice if Sophos could clarify if this is/isn't possible and update their documentation appropriately.