HTTPS Inspection - Chain Errors

[Benjamin_Lamber]

Hi all,

I have a gateway running 80.20 M2 and I recently enabled SSL Inspection for a small group. It is working correctly (I see our cert in the browser and no warnings), but I see some strange errors in the logs and sometimes in the browser about the "certificate chain not signed by a trusted CA".

When I look at the certificate, it seems to be missing the original CA and didn't insert our CA/cert.

For example, normal certs look like: DigicertCA-->www.CDWG.com
Inspection working: MYEnterpriseCA-->www.CDWG.com
When I see errors it looks like: www.CDWG.com

Am I missing something?

Thanks!

--Ben

[PhoneBoy]

It’s impossible for a gateway to be running R80.20.M2 because that’s a Management-only release. What is the gateway actually running here? Also, is this happening consistently for specific sites or at random?

[HeikoAnkenbrand · Accepted solution]

Hi @Benjamin_Lamber 

the DigiCert certificate is not in R80.20 root certificate store.

So you get a certificate chain error.

[HeikoAnkenbrand · Accepted solution]

Look at this sk:

sk114679 - HTTPS Bypass (with Site Category) not working for Servers with Self-Signed Certificate

[HeikoAnkenbrand]

Here the root certificate. This certificate is not in the root certificate store.

[HeikoAnkenbrand]

Here the intermediate certificate:

[HeikoAnkenbrand]

And here the web server certificate:

[HeikoAnkenbrand]

Sorry for the german names in the pictures. I write on a samsung tab s4 and I cannot change the browser to english.

[Benjamin_Lamber · Accepted solution]

Thank you, this was ultimately the issue. For some reason Check Point did not have Digicert Global Root G2/G3 in the certificate store. I was able to download them from their support site and add them.

Is there a way to ensure that the Check Point cert store is being automatically updated, apart from checking the box?

Thank you very much!

--Ben