Sophos XGS and Securly users (with extension) - SSL/TLS errors

[Jaan]

Hello everyone,

 

I'm hoping to get some insight from others who might be running a similar setup. I don't have a critical operational issue, but more of an annoying bugbear with my Sophos XGS reporting.

 

I'm finding that only about 13% of my SSL/TLS traffic is being decrypted, which means I can't see the vast majority of it in my reports. This seemed to start around the time we implemented Securly. I'm not sure if that's coincidental or the cause.

 

When I check the SSL/TLS errors page on the XGS, I constantly see a:

"couldn't validate server certificate (19007)" error against "sslcheck.securly.com

 

All client devices do have the Sophos Certificate installed. However, because we're using the Securly Filter Extension for filtering, the Securly HTTPS certificate isn't necessary for the main filtering to work.

 

Is anyone else using a Sophos XGS firewall alongside the Securly Filter and utilising the Securly extension for user authentication? I'd be very interested to hear if you encountered this same reporting/decryption issue and, if so, how you resolved it!

 

Thanks in advance.

[drutt]

Could be worth adding the Securly certificate to the certificate authorities on the XGS and see if that helps? The error seems to suggest the firewall can't validate it, and it might not recognise the CA:

 

https://docs.sophos.com/nsg/sophos-firewall/21.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/CertificateAuthorities/index.html

[tom_newton]

I know securly opportunistically mitm sites, so some of your traffic will perhaps be hitting their upstream proxy. That's likely what's driving inconsistent behaviour. 

[Wave9_Lee]

What reports are you looking at in Sophos if Securly is doing your filtering?  When our customers deploy a filtering solution behind our firewall, we don't decrypt, just apply minimal/baseline filtering for unmanaged/BYOD/IWB etc

[Jaan]

We have an onion skin approach. we still use sophos for staff. But for students, they are filtered by Securly..... however we also have a sophos rule which contains all the nasties you really don't want the kids accessing as a fail safe.....it's not as granular as securely. We also have Sophos AV web filter that does the same thing as the firewall web filter.

 

The student filter kind works like this: Securly---Sophos AV web filter--- Sophos Firewall

 

like i say, the filtering is working fine, but the a lot of the traffic that passes through the sophos i suspect is securly but it's wrapped in a "secure socket layer protocol" when looking at the XGS Dashboard.

 

Drilling down on Sophos its FW rule 10 which is student AD account webfilter

 

Sophos is reporting only 8% decrypted and looking at the SSL/TLS errors... "sslcheck.securly.com" comes back as "Couldn't validate server certificate (19007)"

 

 

 

[StephenPink]

We double decrypt with Securly and our PaloAlto firewalls - you will need to import the Securly root CA onto your Sophos I assume (that's what we do on the Palo) so that you get full visibility. 

We use Securly to filter/monitor and Palo's to secure - so absolutely do want decryption on both.

Cheers

[Jaan]

On 11/11/2025 at 13:15, StephenPink said:

We double decrypt with Securly and our PaloAlto firewalls - you will need to import the Securly root CA onto your Sophos I assume (that's what we do on the Palo) so that you get full visibility. 

We use Securly to filter/monitor and Palo's to secure - so absolutely do want decryption on both.

Cheers

 

Awesome, your reply and the thread notification reminded to do this..... i'll do it now and see what happens........  Feel like i'm fire fighting at the moment!

[TronXP]

On 11/11/2025 at 12:23, Jaan said:

We have an onion skin approach. we still use sophos for staff. But for students, they are filtered by Securly..... however we also have a sophos rule which contains all the nasties you really don't want the kids accessing as a fail safe.....it's not as granular as securely. We also have Sophos AV web filter that does the same thing as the firewall web filter.

 

The student filter kind works like this: Securly---Sophos AV web filter--- Sophos Firewall

 

like i say, the filtering is working fine, but the a lot of the traffic that passes through the sophos i suspect is securly but it's wrapped in a "secure socket layer protocol" when looking at the XGS Dashboard.

 

Drilling down on Sophos its FW rule 10 which is student AD account webfilter

 

Sophos is reporting only 8% decrypted and looking at the SSL/TLS errors... "sslcheck.securly.com" comes back as "Couldn't validate server certificate (19007)"

 

 

 

I have been doing similar for years, but with a Fortigate. Nice to hear others are doing the same,  I usually get a weird look from people when I explain this approach.

[Jaan]

16 hours ago, TronXP said:

I have been doing similar for years, but with a Fortigate. Nice to hear others are doing the same,  I usually get a weird look from people when I explain this approach.

 

Yeah i get the same......Securly were like "oh, we don't support or recommend that", other Tech guys i've shown the setup to were like, "That seems a lot to maintain".

[StephenPink]

43 minutes ago, Jaan said:

 

Yeah i get the same......Securly were like "oh, we don't support or recommend that", other Tech guys i've shown the setup to were like, "That seems a lot to maintain".

 

I've also had similar - but if you don't, then I don't see how anyone can "claim" they are actually filtering (safeguarding) or securing (firewall) effectively. It is the only way, when using multiple systems that traffic is passing through. Otherwise you might as well not have the one that isn't inspecting SSL - seeing as something like 85% of internet traffic is HTTPS anyway now...

[drutt]

We use our Sophos XGS for both filtering and firewalling, Sophos endpoint with its own web filtering as a last line all connected to Sophos Central.

 

Our monitoring is done by NetSupport DNA, logging all the things students type within their documents or the web and if a keyword is triggered it gets flagged, categorised in terms of risk and an email sent that informs the safeguarding lead.