Hello Mates!
I am currently working to enable HTTPS Inspection for a customer. After configuring the basics (CA cert import, basic ruleset, Manual Update of Trusted CA List), we enabled the Inspection for a testing Host and noticed that a lot of URLs were still causing Warnings in the browser about the connection not beeing secure.
After checking the logs, I noticed that there were a lot of logs for the Inspection Blade showing "action: Detect" and "HTTPS Validation: Untrusted Certificate"
I did a manual update of the Trusted CA List before, so I was a bit surprised to see that things were still missing there. After checking all the URLs used for testing and what certs they use, I started importing the missing certs one by one. That is a lot of manual work and when I look at what certs were missing there, I get the impression that I did somethign wrong, or missed something, as I would have thought that the List provided from Check Point would contain popular and often used CA certs like "Amazon Root CAx" , the main Microsoft Azure root CAs, DigiCert root CAs or Let's Encrypt CAs for example.
I imported around 12 certs manually now but still see a lot of "Untrusted Certificate" warnings in the Logs. This is only for one Host so far that I used for testing. I can only imagine what would have happened if we would have activated this for a bigger number of users right away.
So my questions abnout this:
1. Did I miss something here or is it really expected behaviour? Is it really required for using HTTPS Inspection to check a lot of URLs for certs and import a lot of certs manually??
2. I suspect the manually imported certificates will also not be updated automatically, so is it required to regular check this list for outdated manually imported certs?
Any Tips that help with this are welcome!
Best Regards,
Alex
