unable to access mail.Google.com cert expired (Sophos XG)

[Jaan]

starting today, all our users are unable to access their Gmail accounts.

 

The error relates to the mail.google.com cert date has expired, Sophos XG cert still valid

 

I have confirmed the HTTPS cert we push out to our users is still valid which it is.

 

Somethings expired today, just not sure how i fix it. Here's some screens, any ideas?

 

 

 

[Jaan]

UPDATE: I've added mail.google.com to our https cert exceptions which fixes the issue. I'm still confused why it stopped working though?

[ibpalle]

Says certificate is valid until the 2nd. Could mean that once 2nd Sept comes round it's invalid. Since the message says date is invalid, that could be the case.

[Jaan]

my sophos xg cert is valid until 2023

[PaddyNewman]

Not according to your post, it expires today? 2 years 3 month certificate length, that is 800 days on the dot, which sounds like a manually made cert.

[Jaan]

Here's my deployed https: certs for my XG.

 

only affecting Google services. lots of issues this morning still

 

 

[PaddyNewman]

Does Sophos have a cache of certs it's faked up, might be worth clearing that if so?

[Jaan]

Does Sophos have a cache of certs it's faked up, might be worth clearing that if so?

 

good call!...... however i can't find the cache for the life of me.

[Jaan]

I've powered down our XG and cold booted it again (can't find where they have put the clear cache buton in the GUI).

 

However i still have the issue.

 

if i type

www.google.com

into chrome i get a invalid cert (expired), however if i type

www.google.es

it works fine.

 

[lmrogers]

I believe I've had similar issue before

 

https://community.sophos.com/sophos-xg-firewall/f/discussions/102313/https-scanning-where-is-the-certificate-cache-for-external-websites

 

The solution was on that thread, needed to SSH into the firewall and use the advanced shell.

[Jaan]

I believe I've had similar issue before

 

https://community.sophos.com/sophos-xg-firewall/f/discussions/102313/https-scanning-where-is-the-certificate-cache-for-external-websites

 

The solution was on that thread, needed to SSH into the firewall and use the advanced shell.

 

can i do this directly on the XG?

 

don't suppose you have any links to instructions on the commands i need to run do you? Never have to do this before.

 

thanks

[PaddyNewman]

Looks to be just

• SSHing to the XG
  
• Chose »5. Device Management
  
• Chose »3. Advanced Shell
  
• Identified the certificate(s) in /var/certcache/ and removed the cached files (if its just a Linux box, then ls | grep google and find the right one, rm name-of-file)
  
• Then went to Protect > Web in the Web Management Interface an clicked Apply on »HTTPS Decryption and Scanning« without changing any setting there
  

[Jaan]

you're a star!

 

worked a charm!

[PaddyNewman]

Weird that its not configured to mark expiring/expired certs and purge... cached certs are a quick way of faking and saving the hassle on each inspection, but I'd have expected it to have a TTL or similar to mark it for deletion. Oh well

[Jaan]

Weird that its not configured to mark expiring/expired certs and purge... cached certs are a quick way of faking and saving the hassle on each inspection, but I'd have expected it to have a TTL or similar to mark it for deletion. Oh well

 

being able to do it in the Sophos gui with having to ssh would also be helpful!

[PaddyNewman]

Ideally, fully automatic and nothing needed by the end-user, I imagine everyone has plenty other important tasks!

 

Might be a good feature request to Sophos? I have no contacts within Sophos, however I imagine its as simple as a 'Clear cached certificates' button that simply runs a service/command to clear the folder.

[Jaan]

Ideally, fully automatic and nothing needed by the end-user, I imagine everyone has plenty other important tasks!

 

Might be a good feature request to Sophos? I have no contacts within Sophos, however I imagine its as simple as a 'Clear cached certificates' button that simply runs a service/command to clear the folder.

 

with regards to "clearing the folder" i've had acouple more domains today with the same error...... might be best to just purge the lot!

 

If i just rm * in that directory, i assume it just contains certs?

[Wave9_Lee]

There's a fix for this in the next SFOS update - probably September. As the current fix requires clearing out files via CLI, its best to get qualified help - All Sophos licences come with access to Sophos Support to do this, or Wave 9 customers can drop us a note and we'll do it for you.

[Jaan]

There's a fix for this in the next SFOS update - probably September. As the current fix requires clearing out files via CLI, its best to get qualified help - All Sophos licences come with access to Sophos Support to do this, or Wave 9 customers can drop us a note and we'll do it for you.

 

Awesome thanks lee