Smoothwall https interception certificate/G suite problem

[Tammie]

Hello all

 

We've had a problem with our Chromebooks since the Chrome OS 70 update, namely that the Smoothwall https certificate that used to be deployed via the G Suite admin console is no longer working, ie all updated Chromebooks can't do anything without a privacy error. After much testing, I can get the same certificate from smoothwall/modules/guardian3/mitm/ and install that manually, which fixes it. It's the same certificate as in the admin console, so I know it's not a problem with the certificate already in there. At the moment I'm doing them one by one as they update ... we have 250 odd. I'm not even sure if it's a Smoothwall problem or a G Suite problem.

 

Anyone else have the same issue?

 

TIA

[russlp]

Hi Tammie,

 

We are having the same issue here. Did you manage to solve it at all?

 

Many thanks

[Tammie]

Hi

 

No - I've spoken to Google about it and they've asked for lots of screenshots, which I've provided. They said they were aware of the issue.

 

Is it the same for you? Smoothwall and G Suite?

[russlp]

yep, all the same. Working fine on the previous versions of Chrome OS but not 70!

[russlp]

I've just regenerated our certificates as RSA, 4096-bit instead of RSA, 2048-bit and this has fixed the problem!

[Tammie]

It's nice to know it's not just us! If I hear anything, I'll post it.

 

- - - Updated - - -

 

That's great news! I will try that.

[Arthur]

I'm not even sure if it's a Smoothwall problem or a G Suite problem.

I had exactly the same issue with G Suite and Chromebooks, but my school has a Sophos XG. I think Google have changed something recently.

 

After speaking with Google Cloud support we found out it was caused by the HTTPS interception certificate missing several "extensions" (the most important being the keyUsage extension).

 

I therefore modified our existing XG MITM certificate to include these using OpenSSL (without changing the CN or private key) and it now works.

 

https://serverfault.com/questions/861975/re-issuing-self-signed-root-ca-without-invalidating-certificates-signed-by-it

 

[color="#FF0000"]basicConstraints = critical, CA:TRUE, pathlen:0
keyUsage = critical, keyCertSign[/color]
subjectKeyIdentifier = hash
subjectAltName = @Alt_names

 

Perhaps when @russlp regenerated the certificate it added the missing extensions?

[russlp]

Yes, I think your're right. Our original certificates were created a while ago and didn't have all the extensions that the new ones do.