Firmware 4.3.8.1 & expired certificate 30th May 2020

How is this not answered yet?

This breaks a significant number of sites, including some from governmental organizations.

I will try to add the corrected Root CAs myself, but if I wanted to manage my own solution, I wouldn't have bought an appliance, Sophos.

I get not trusting Comodo just because they changed their name, but at least give us an official statement so we know where we're at.

For others - the respective Comodo pages are https://support.sectigo.com/Com_KnowledgeDetailPage?Id=kA03l00000117WR and https://support.sectigo.com/Com_KnowledgeDetailPage?Id=kA03l00000117LT - however, they, too, are using the certs rejected by the SWA under 4.3.10.

I have manually added USERTrust RSA Certification Authority self-signed, USERTrust RSA Certification Authority signed by AAA Certificate Services and COMODO RSA Certification Authority.

It is my understanding (from https://support.sectigo.com/Com_KnowledgeDetailPage?Id=kA01N000000rgSZ) that at least the latter should have provided a usable trust anchor.

Unfortunately, there is no noticeable change.

Hilariously, while trying to look at the changelog referenced by OP, it turned out that Sophos' own Site is equally challenged, because the SWA doesn't trust swa.sophos.com's GlobalSign chain.

Not looking good here, Sophos.

I have manually added USERTrust RSA Certification Authority self-signed, USERTrust RSA Certification Authority signed by AAA Certificate Services and COMODO RSA Certification Authority.

It is my understanding (from https://support.sectigo.com/Com_KnowledgeDetailPage?Id=kA01N000000rgSZ) that at least the latter should have provided a usable trust anchor.

Unfortunately, there is no noticeable change.

Hilariously, while trying to look at the changelog referenced by OP, it turned out that Sophos' own Site is equally challenged, because the SWA doesn't trust swa.sophos.com's GlobalSign chain.

Not looking good here, Sophos.