topic HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain? in General Topics

HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain?

B_P — Mon, 23 Jan 2023 18:11:32 GMT

Browsing to a website such as www.thisdomain.io which uses a *.thisdomain.io wildcard certificate and the firewall blocks it saying

"Certificate chain is inconsistent. Certificate DN: 'CN=*.thisdomain.io' Requested Server Name: www.thisdomain.io See sk159872".

Everything in sk article checks out and I'm not seeing any issues. What's odd is the example in the sk even shows a wildcard. Is it having an issue with the .io TLD?

What's even odder is that the website works sporadically. No issues if browsing the website off-premise (i.e. not going through a cpfw). R81.10 latest JHF.

Re: HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain?

the_rock — Mon, 23 Jan 2023 21:49:33 GMT

See if below helps:

https://community.checkpoint.com/t5/Security-Gateways/HTTPS-Certificate-validation-SK159872/td-p/131158

Btw, I dont think TLD matters here at all.

Re: HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain?

PhoneBoy — Tue, 24 Jan 2023 04:28:37 GMT

This is most likely a side effect of SNI Verification and something on the remote end that isn't configured correctly...perhaps on only on one server in a pool of them.
You might need the TAC to assist in debugging this.

Re: HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain?

Alex- — Tue, 24 Jan 2023 09:05:23 GMT

You could check sk105559 - How to debug the WSTLSD daemon also.

Re: HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain?

B_P — Wed, 01 Feb 2023 15:49:44 GMT

Looks like there's no issues:

WSTLSD log:
[1 Feb 9:39:12] fwCert_cache::val_free: free fwCert from Cache. refCount: 0, CN=*.thisdomain.io
[1 Feb 9:39:12] fwCert_cache::Put: added fwCert 0xab10200 to cache
[1 Feb 9:39:12] fwCert_cache::Get: added new cert object to cache: *.thisdomain.io
[1 Feb 9:39:12] fwCert_cache::Get: cache hit for : 16
[1 Feb 9:39:12] cpSRSA_imp::Verify: Entering...
[1 Feb 9:39:12] kmsg_read_local: 9 kmsgs handled
[1 Feb 9:39:12] Comparing SNI www.thisdomain.io against 2 alternative names
[1 Feb 9:39:12] SNI matches alternate name *.thisdomain.io
[1 Feb 9:39:12] Comparing SNI www.thisdomain.io against 2 alternative names
[1 Feb 9:39:12] SNI matches alternate name *.thisdomain.io

Re: HTTPS Inspection: "Certificate chain is inconsistent" for wildcard domain?

B_P — Wed, 01 Feb 2023 16:03:45 GMT

I scanned it with Qualys and it got a B grade as it has chain, alternative name and SNI issues...... I guess I'll reach out to them.