Problems getting SSL Inspection working

[road hazard]

I followed this guide: https://support.untangle.com/hc/en-u...s/360034431274



....so far so good......... generated the cert and imported it into my browser but I can't reach Google: (or some other sites)




Was searching the forum and saw similar posts about SSL inspection/cert problems and unless I'm wrong, lots of sites (Google in particular) just won't load when it detects any kind of tampering with the connection. In which case, go ahead and enable SSL Inspection and just create rules to bypass any and all sites that refuse to load? Or save myself some headaches and give up on this app?

[jcoffin]

The self generated certs will never be trusted by the browser since the Certificate Authority (CA) is not recognized by the browser. If you want to avoid this screen, the CA needs to be installed on each PC behind the NGFW.

[jcoffin]

This is the missing step. https://support.untangle.com/hc/en-u...-certificates-

[road hazard]

This is the missing step. https://support.untangle.com/hc/en-u...-certificates-

I'm -almost- positive I did that but I'll re-do it here in a minute and let you know, thanks!

EDIT: Yup, user error. Maybe I put it in Personal last time?! In any case, SSL Inspection is active and Google is working. Unfortunately, I think my SSL inspection journey is over as soon as it started. Looks like you can't enable this on Android devices and if I turn on SSL Inspection, my Android phones start having connection problems. I guess I could exclude them and still use it for the other devices? Now I'm starting to wonder if it's even worth it. Anyone else using it at home? Getting extra benefit from it?

[gravenscroft]

Looks like you can't enable this on Android devices and if I turn on SSL Inspection, my Android phones start having connection problems.

Yup. For a long time, the Android OS was hard-coded never to trust a self-signed certificate, so installing the root CA wouldn't have any effect. I don't think that's still the case, but Android and SSL Inspector still don't play nicely together. I think it's also very difficult or impossible to do this with iOS devices as well.

Now I'm starting to wonder if it's even worth it. Anyone else using it at home? Getting extra benefit from it?

In short: it's not, and you're not. SSLI only really improves a few things:

• Spam Blocker & Phish Blocker: enables scanning of TLS-encrypted email. Unless you have an on-premise email server, you're not using these apps anyway.
• Virus Blocker & VB Lite: enables scanning of TLS-encrypted traffic. This is slightly more beneficial, but virus blocking at the gateway is at best a complement to more specialized endpoint protection.
• Web Filter: enables URI-based filtering (everything after the .com/ part of a URL). SSLI absolutely isn't necessary for Web Filter to do its thing; if I had to guess, I'd say upwards of 90% of NG Firewall installations run Web Filter without SSLI and do just fine.

Given that using SSL Inspector requires a lot of additional criteria and effort, I often steer people away from it. It doesn't do very much any more, and what you get isn't (in my not-especially-humble-opinion) worth the significant extra hassle.

[road hazard]

Yup. For a long time, the Android OS was hard-coded never to trust a self-signed certificate, so installing the root CA wouldn't have any effect. I don't think that's still the case, but Android and SSL Inspector still don't play nicely together. I think it's also very difficult or impossible to do this with iOS devices as well.


In short: it's not, and you're not. SSLI only really improves a few things:

• Spam Blocker & Phish Blocker: enables scanning of TLS-encrypted email. Unless you have an on-premise email server, you're not using these apps anyway.
• Virus Blocker & VB Lite: enables scanning of TLS-encrypted traffic. This is slightly more beneficial, but virus blocking at the gateway is at best a complement to more specialized endpoint protection.
• Web Filter: enables URI-based filtering (everything after the .com/ part of a URL). SSLI absolutely isn't necessary for Web Filter to do its thing; if I had to guess, I'd say upwards of 90% of NG Firewall installations run Web Filter without SSLI and do just fine.

Given that using SSL Inspector requires a lot of additional criteria and effort, I often steer people away from it. It doesn't do very much any more, and what you get isn't (in my not-especially-humble-opinion) worth the significant extra hassle.

Well, I guess it was a fun experiment while it lasted but those are great points. I guess I'll go ahead and disable it and won't bother. Thanks for the info!