WAF not serving CA about sophos-utm-letsencrypt HOT 4 CLOSED

I have seen the same issue also with backend server without ssl. Currently I think it might have something to do with the link between the ca cert and domain cert. I will try to reproduce the issue and find a solution.

from sophos-utm-letsencrypt.

Hi Rene, thanks for your great work.
I think the way trollvottel described would be a really good solution.
Simply importing full_chain (appended .crt + chain.crt).
Another solution would be to let getssl create fullchain.crt or fullchain.pem and import these directly.
srvrco/getssl#27
This can be achieved via using parameter:
#DOMAIN_CHAIN_LOCATION="" this is the domain cert and CA cert
#DOMAIN_PEM_LOCATION="" this is the domain_key. domain cert and CA cert

Maybe you can change your script accordingly to use these to import to UTM.

from sophos-utm-letsencrypt.

I also had the issue that my new Certificate wasn't served in a chain bundle with the intermediate cert.
This was some weeks ago, so I don't exactly remember, but I think the WAF serves just the domain cert, unless the real webserver also returns the intermediate cert. I was rather confused why changing the certificate bundle on the real webserver had any effect on the Sophos-Terminated SSL connections, but that seems to work for me.
Workaround might be deploying the proper certificate chain to your real webserver.

from sophos-utm-letsencrypt.

Try to append the intermediate-ca-cert to the host-cert and import that as the 'host_key_cert'.

FYI: Firefox tricks you into thinking the chain is setup correctly because it caches the intermediate-ca-cert, it may also have been seen already by visiting another letsencrypt-signed site... You better use https://www.ssllabs.com/ssltest/ to check.

BTW: WebAdmin itself does not serve the chain either. A well-known, long-standing bug in Sophos UTM.

from sophos-utm-letsencrypt.