topic Re: SSL: Firewall uses untrust-forward cert. for every site in General Topics

SSL: Firewall uses untrust-forward cert. for every site

cryptochrome — Sun, 26 May 2013 11:36:58 GMT

Hi,

I just set up SSL Decryption exactly as described in the Getting Started Guide (English)

I have one trusted-forward certificate, imported into browsers, and one untrust-orward certificate, not imported into browsers.

Now when I connect to SSL sites, my browsers complain about untrusted certificates, the firewall is clearly using the untrust-forward certificate. When I configure the imported trust-forward certificate to be the untrust-forward certificate (so the imported certificate is both at the same time), everything works fine.

Something is wrong here. Any ideas?

Thanks

Sascha

Re: SSL: Firewall uses untrust-forward cert. for every site

Retired Member — Sun, 26 May 2013 11:45:05 GMT

Hi,

Re: SSL: Firewall uses untrust-forward cert. for every site

cryptochrome — Sun, 26 May 2013 11:56:30 GMT

Thanks, but I don't think this is my problem. In my case, *every* site is being signed by the untrust-forward certificate. Even large ones like Google or Facebook.

Re: SSL: Firewall uses untrust-forward cert. for every site

cryptochrome — Sun, 26 May 2013 14:08:40 GMT

I digged a little deeper and it seem the firewall is declaring each site's certificate as "untrusted" (see attached screenshot). So either the firewall is unable to check the certificates or there is some other issue. The list of default trusted CA authorities is populated with roughly 260 entries, so that looks ok. I need some help here, something is going very wrong.

Re: SSL: Firewall uses untrust-forward cert. for every site

panagent — Fri, 31 May 2013 21:12:01 GMT

This document may help

Re: SSL: Firewall uses untrust-forward cert. for every site

gwesson — Sat, 01 Jun 2013 00:14:16 GMT

The firewall seems to be having trouble with the issuers as you have shown. The large list of CAs should indicate that it is working fine, and I have not seen this issue before. A couple questions that may help:

1. What OS version is your firewall running?

2. Is the content up to date? The most current as of this posting is 375-1810. You can confirm it by looking under the dashboard, or Device > Dynamic Updates.

3. Is there any other SSL interception/proxy device being implemented? Another firewall or a proxy may cause this.

Hope this helps,

Greg Wesson

Re: SSL: Firewall uses untrust-forward cert. for every site

cryptochrome — Sat, 01 Jun 2013 09:35:40 GMT

Hi,

please forget about it. I deleted all my certificates and re-created them from scratch, rebooted the firewall and now it is working fine. Not sure why it would use the wrong certificate, something must have got messed up. It's working fine now. Thanks for your help guys.