Smoothwall randomly showing cert errors

[Sheridan]

A few staff have reported a seemingly random issue where a browser (chrome or edge) will show the certificate error - as if the Smoothwal cert wasn't installed on the PC (which it is) and they get all sorts of errors/warnings so can't use the browser

 

In the logs we see a lot of these 200 - Sucess but in red

 

Oddly the error seems to go away after a logoff and log back in - its pretty random where its hit (same OS level)

 

We do https inspect search engines - and the cert is deployed network wide so I can't find a reason we're seeing this?

[tom_newton]

Youve not got some folks without a cert using cloud filter have you?

OR maybe there's an AV or something interfering? 

Be good to show that cert the user gets when it fails

[E_G_R2]

We had similar on a very few machines.  It was a corrupt registry.pol file.  We renamed it and then the certificate installed.

[Sheridan]

Definitely not cloud filter. And now its weirder as when I checked this morning the cert was there. I rebooted the PC and it wasn't there! I manually added it and its working now, so it not a problem at the smoothwall end at all - the certificate itself is playing hide and seek!

[5tu]

We're seeing issues on some devices using cloud filter where they aren't successfully registering a secret knock on the smoothwall appliance and so are getting double filtered.  To make it worse, smoothwall appliance is filtering them as "Unauthenticated IP" devices so the wrong filtering policy is getting applied.

 

Anyone else seeing the same?

 

Sorry to highjack your thread @Sheridan

[E_G_R2]

The corrupt registry.pol was preventing GPO from passing on the certificate in our case.  Rename it to something line registry.pol.old reboot and it created new file and installed the cert from the GP. 

[synaesthesia]

Is it definitely smoothwall cert showing up as the error?

Had very similar but it was Sophos interfering despite having none of its HTTPS stuff enabled.

[Sheridan]

In my case the symptoms were definitely that the certificate was invalid or missing, but the cause was at the PC end. I've checked the GPO that holds the cert and its correct so I'll wait and see if it crops up again on another PC

[synaesthesia]

For us it was so intermittent it took nearly 6 months back and forth with Sophos and seems to have resolved itself. Clients would present exactly as you described, and a reboot or browser restart often resolved it. The best reason we could find for this happening was a delay in resolving the certificate chain possibly down to local network conditions; the only thing that changed since it stopped happening was a full WiFi network replacement. 

Wonder if, even if not relating to AV, a network delay might also be involved?

I do know it never happened on any wired device. 

Was a strange one for sure, Sophos kept going round in circles after seeing logs, packet traces and thinking it may have been smoothwall or Impero. I hate intermittent issues we can't reproduce!

[Sheridan]

1 hour ago, synaesthesia said:

For us it was so intermittent it took nearly 6 months back and forth with Sophos and seems to have resolved itself. Clients would present exactly as you described, and a reboot or browser restart often resolved it. The best reason we could find for this happening was a delay in resolving the certificate chain possibly down to local network conditions; the only thing that changed since it stopped happening was a full WiFi network replacement. 

Wonder if, even if not relating to AV, a network delay might also be involved?

I do know it never happened on any wired device. 

Was a strange one for sure, Sophos kept going round in circles after seeing logs, packet traces and thinking it may have been smoothwall or Impero. I hate intermittent issues we can't reproduce!

Its particularly odd for us, as the cert was generated last year so has been deployed for a good while and this issue has only cropped up a couple of times - well, only a couple of reported times