smoothwall connection is not private

[mrstrong]

seeing this for this site

https://www.thinkuknow.co.uk/

we do https inspection and you can click advanced and proceed and it loads as "not secure"

the certificate says it is invalid (issued by Digicert)

 

From memory shouldn't this be the CA smoothwall showing as we are doing inspection?

Just tried another site mxtoolbox.com that loads fine and the cert is valid issued by Amazon (again not smoothwall)?

 

Mmm just realised this chromebook is using Smoothwall’s client-based Cloud Filter so maybe that makes a difference.

 

I guess I could just add thinkuknow.co.uk to a do not inspect category but still curious as to why getting invalid cert ?

[pete]

The certificate chain on the website is incomplete*. It probably wouldn't prevent a web browser accessing it, but Smoothwall (in HTTPS intercept/validate cert mode) is a lot more nitpicky about the server config being correct.

 

Adding the intermediate cert to SW *may* resolve the issue if it's missing.

 

* https://www.ssllabs.com/ssltest/analyze.html?d=www.thinkuknow.co.uk (and it was renewed 10 days ago, which may have introduced the behaviour)

Edited October 17, 2022 by pete
typo and more info.

[ibpalle]

Try to add the intermediate CA used as pete suggests. This can be uploaded to the Smoothwall in the system - certificates - certificate authorities section. You can download the intermediate CA from you local certificate store in crt or pem.

[mrstrong]

@ibpalle regarding Smoothwall’s client-based Cloud Filter: am I correct in thinking that the

smoothwall is not acting as a MITM (i.e. decrypting and re-signing with its own cert) ?

 

E.g. the browser is talking direct to the website over HTTPS but once the browser decrypts

the page the client extension kicks in to parse the content and apply rules (rules must be stored on client) ?

So its not really filtering "in the cloud" ?

[tom_newton]

You're correct that the filtering actually takes place on the client with the extension - it's more reliable and scalable.

[ibpalle]

E.g. the browser is talking direct to the website over HTTPS but once the browser decrypts

the page the client extension kicks in to parse the content and apply rules (rules must be stored on client) ?

So its not really filtering "in the cloud" ?

 

Correct - HTTPS inspection is irrelevant as the extension filters once the browser has received the page and decrypted it. The filtering is done by the extension - it's not a redirect to a proxy hosted elsewhere.