This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Captive Portal / Blocked Page (Port 8090) Presents Wrong Certificate

Kia ora!

I'm running (SFOS 18.0.3 MR-3). I was under the impression that the certificate selected in admin settings should be used for all XG services but I'm being presented with a different one on port 8090:

I've tried setting the certificate back to the default one then back to my self-signed one again. I've tried rebooting the FW.

Am I missing a setting somewhere?

Cheers,

Rhys

This thread was automatically locked due to age.

Top Replies

Rhys Goodwin over 3 years ago in reply to LuCar Toni +2 suggested

Ah! Sorry guys, thought I'd done good search of the forum before starting this thread. Anyway it started working (started presenting the correct cert) and I'm 99% sure it just after I changed the Web proxy…

Parents

0 LuCar Toni over 3 years ago

Looks like the same issue as here: https://community.sophos.com/xg-firewall/f/discussions/123597/xg-18-mr3-use-incorrect-certificate-in-web-warn-block-page

Michael Dunn Can we look into this?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Rhys Goodwin over 3 years ago in reply to LuCar Toni

Ah! Sorry guys, thought I'd done good search of the forum before starting this thread. Anyway it started working (started presenting the correct cert) and I'm 99% sure it just after I changed the Web proxy scanning mode from batch to real-time. Changed it back and it's still ok. So I wonder if this has triggered an update of the cert being used?
Cancel
Vote Up +2 Vote Down

Cancel

Reply

0 Rhys Goodwin over 3 years ago in reply to LuCar Toni

Ah! Sorry guys, thought I'd done good search of the forum before starting this thread. Anyway it started working (started presenting the correct cert) and I'm 99% sure it just after I changed the Web proxy scanning mode from batch to real-time. Changed it back and it's still ok. So I wonder if this has triggered an update of the cert being used?
Cancel
Vote Up +2 Vote Down

Cancel

Children

0 Tanapol Euaungkanakul over 3 years ago in reply to Rhys Goodwin

Hi, I already try your suggestion be switching between batch to real-time and It just won't work.
It just keeps sending self signed cert to blockpage 8090
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Tanapol Euaungkanakul

You guys all use a own certificate, not the sophos certificate.
Is this a CA or a "normal" certificate? Is it a wildcard? Can we try to find a matching pattern?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Pascal_Ammersbach over 3 years ago in reply to LuCar Toni

In our case, we use our own wildcard certificate (which is bought) for WebAdmin, UserPortal and Captive Portal (which has the issue). We need that, because our UserPortal needs to be accessed from external Users which are not in our Domain and cannot have the Sophos in the trusted root CA.

For Webfiltering etc. we use the Sophos CA which is configured in GPO to be trusted.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to Pascal_Ammersbach

Hi Pascal_Ammersbach,

I would advise you to open a support case for further investigation at support.sophos.com and PM me the case number.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel