topic Re: HTTPS Inspection - Chain Errors in Firewall and Security Management

HTTPS Inspection - Chain Errors

Benjamin_Lamber — Fri, 29 Mar 2019 16:54:52 GMT

Hi all,

I have a gateway running 80.20 M2 and I recently enabled SSL Inspection for a small group. It is working correctly (I see our cert in the browser and no warnings), but I see some strange errors in the logs and sometimes in the browser about the "certificate chain not signed by a trusted CA".

When I look at the certificate, it seems to be missing the original CA and didn't insert our CA/cert.

For example, normal certs look like: DigicertCA-->www.CDWG.com
Inspection working: MYEnterpriseCA-->www.CDWG.com
When I see errors it looks like: www.CDWG.com

Am I missing something?

Thanks!

--Ben

Re: HTTPS Inspection - Chain Errors

PhoneBoy — Sat, 30 Mar 2019 16:03:19 GMT

It’s impossible for a gateway to be running R80.20.M2 because that’s a Management-only release. What is the gateway actually running here? Also, is this happening consistently for specific sites or at random?

Re: HTTPS Inspection - Chain Errors

HeikoAnkenbrand — Sat, 30 Mar 2019 17:14:34 GMT

Hi @Benjamin_Lamber

the DigiCert certificate is not in R80.20 root certificate store.

So you get a certificate chain error.

Re: HTTPS Inspection - Chain Errors

HeikoAnkenbrand — Sat, 30 Mar 2019 17:20:51 GMT

Look at this sk:

sk114679 - HTTPS Bypass (with Site Category) not working for Servers with Self-Signed Certificate

Re: HTTPS Inspection - Chain Errors

HeikoAnkenbrand — Sat, 30 Mar 2019 17:39:30 GMT

Here the root certificate. This certificate is not in the root certificate store.

Re: HTTPS Inspection - Chain Errors

HeikoAnkenbrand — Sat, 30 Mar 2019 17:32:52 GMT

Here the intermediate certificate:

Re: HTTPS Inspection - Chain Errors

HeikoAnkenbrand — Sat, 30 Mar 2019 17:34:34 GMT

And here the web server certificate:

Re: HTTPS Inspection - Chain Errors

HeikoAnkenbrand — Sat, 30 Mar 2019 17:37:35 GMT

Sorry for the german names in the pictures. I write on a samsung tab s4 and I cannot change the browser to english.

Re: HTTPS Inspection - Chain Errors

Benjamin_Lamber — Mon, 01 Apr 2019 14:37:25 GMT

Thank you, this was ultimately the issue. For some reason Check Point did not have Digicert Global Root G2/G3 in the certificate store. I was able to download them from their support site and add them.

Is there a way to ensure that the Check Point cert store is being automatically updated, apart from checking the box?

Thank you very much!

--Ben