No internet after SSL certificate (HTTPS inspection)

[Koldov]

I really don't know where to start with this one, but a 5 minute job on Friday at 15:30 has turned into a bit of an issue...

 

My Headteacher has a Macbook and I'll be honest, it has caused plenty of issues over the few years they've had it and I've made it clear I'm not really qualified in supporting Macs but can normally sort it out in the end (thanks to Edugeek and the internet in general).

 

However, we are working towards HTTPS inspection and this Macbook is the last piece of the puzzle before enabling it site-wide. All I needed to do was install an SSL certificate... which in theory looking at the instructions is relatively simple.

 

As the Headteacher is always 'far too busy' for me to actually have their precious Macbook for any amount of time, I jumped at the chance on Friday afternoon when they said they could spare 5 minutes to get that certificate installed...

 

Downloaded certificate, clicked it, added it in 'ADD CERTIFICATE' to 'SYSTEM', went into keychain and selected 'ALWAYS TRUST'.

 

Tried to go to the certificate check website and.... nothing, page wouldn't load, in fact there was no internet access at all... also no ping (when I found out how to do that).

 

Anyway, they came back and I admitted there was something wrong and I was working on it, but they took it and said sort it out Monday (obviously in a hurry to start their weekend)...

 

So, here we are and I'm none the wiser... the only clue I have is that a while ago we implemented some sort of network locations 'profile' possibly network related for Work and one for Home... strangely enough it is the Work one that no longer works and the Home one now works at work... seriously WTF?!

 

Would having an SSL certificate installed cause this on a Mac? I've just finished the whole Windows estate with zero issues or errors...

 

EDIT: Just to add, I've deleted the certificate now but no change, still no network access or internet...

Edited May 13, 2024 by Koldov

[georgeescott]

Downloaded certificate, clicked it, added it in 'ADD CERTIFICATE' to 'SYSTEM', went into keychain and selected 'ALWAYS TRUST'.

 

Yep, that's all you should need to do.

 

I've previously had issues with trusted SSL Certificates on macOS. A reboot normally solves most issues with captive portals and SSL Certificates.

 

So, here we are and I'm none the wiser... the only clue I have is that a while ago we implemented some sort of network locations 'profile' possibly network related for Work and one for Home... strangely enough it is the Work one that no longer works and the Home one now works at work... seriously WTF?!

 

I've also had issues with the 'location' and no internet access (which weren't related to SSL deep inspection), and turning it to 'Automatic' solved internet access issues. Not sure on your setup for Home/Work though, but worth a look/test.

 

I've also had issues where Avast or McAfee installed on the device interfering with it.

Edited May 13, 2024 by georgeescott

[Koldov]

Well, after a lot more testing it appears that it might be something to do with 'network location' profile... once changed I was able to install the certificate and still have internet access (including the certificate check website)... changing back to the work profile = no internet/network access.

 

I'm not sure what has changed but switching it to automatic does work becaujse it gets a DHCP IP address, the 'Work' network location profile was set to a static IP due to the firewall on the VM that runs SIMS....

 

I didn't want to open it up, so just allowed access from one IP and set the Macbook to have a static IP at work. This has worked fine up until now...

 

Something must have changed on the switches maybe? Has that IP address been blacklisted by the switches or something. The static IP comes from the correct VLAN sub and is in the excluded IP address range...

[Koldov]

Okay, yes that's narrowed it down...

 

Setting it to the original static IP of 1.2.3.4 means no network or internet access...

 

So, as the excluded range is 1.2.3.4 > 1.2.3.4.9.... I just chose the next static of 1.2.3.5 and it worked!

 

How do I find out what's wrong with the original static IP?

 

Cisco WLC 5508 > Cisco Core Switch 3750 (acting as DHCP server)

 

I've run show ip dhcp conflict to try and see if it's blacklisted on the switch, but obviously it's not in a DHCP range as it's excluded...

 

When setting the Macbook IP address to the original static IP of 1.2.3.4, on the WLC tracing it by MAC address shows an IP of 0.0.0.0 but with the new static, it shows correctly as 1.2.3.5

[Koldov]

After narrowing it down to a 'network' issue and possibly not Mac related, I will start a new thread in the appropriate forum.