Education Digital Services - Lancashire - Connection is not private

[Patrick]

I've a few schools reporting that some sites aren't loading and throwing a "Your connection is not private". It's some sort of certificate error with Netsweeper, refreshing the page a few times normally sorts it/ I've reported to LCC but they just asked what site it was and added it to the allowed list, even though it's not blocked in the first place.

 

Anyone else having issues?

[mavhc]

Assuming you've installed the right CA cert, it would seem that Netsweeper is sometimes using a different one, check the certs when it works vs fails

[Patrick]

Yeah the LA provides the service and the cert. They are in the process of moving schools to Netsweeper cloud, basically moving it off their own servers to Netsweepers. I'm assuming something is going wrong with this. Some sites work, some don't and refreshing the page once or twice solves it.

[JezR]

Yes, I'm seeing this in one of my schools.

 

This school is on EDS Netsweeper, not been migrated to Netsweeper Cloud yet.

[PotNoodleTech]

That message is usually a certificate error - has the certificate expired?

[JezR]

I'm seeing CERT_COMMON_NAME_INVALID, and indeed it is.

 

Just had a staff member with this error, upon investigation, the Common Name in the certificate is not for the URL they requested.

Refreshed the page and everything worked OK.

 

Looks like Netsweeper having problems when replacing the certificate following the MITM filter.

[Patrick]

One of my schools had a reply from LCC this morning, stating they are aware of the issue, and it's due to newer versions of chrome and edge having issues with the Netsweeper cert. The current fix is that we should install older versions. Erm, no thanks! Too many schools/devices, it'd be a nightmare to manage not to mention potentially unsafe putting outdated browsers on. The alternative advice is make use of the No Decrypt group but that's reduced filtering so I won't be doing that either! Hopefully Netsweeper have a solution soon.

[Anonymous2000]

This thread "Chrome v124 - ERR_SSL_KEY_USAGE_INCOMPATIBLE" is relevant. That is the cause of the NS issue.

[Patrick]

Thanks for that, so it seems it's very widespread then and not just a Netsweeper issue!