Browser certificate warning when you visit HTTPS websites if Web Gateway is using the SSL Scanner with content inspection

Technische artikelen ID: KB86362
Laatst gewijzigd: 10/21/2021

Omgeving

McAfee Web Gateway (MWG)

Probleem

The web browser displays a certificate warning when visiting HTTPS websites. This issue occurs if Web Gateway is using the SSL Scanner with content inspection enabled. The certificate warning message varies based on the web browser:

Mozilla Firefox blocks the website and displays the warning message: The certificate is not trusted because it was signed using a signature algorithm that was disabled because that algorithm is not secure.
Google Chrome allows the website, but displays the warning message: The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1.

Oorzaak

Starting January 1, 2016 most web browsers are phasing out trust of certificates signed using SHA-1. Any certificates signed after January 1, 2016, are untrusted in some way. (The way varies based on the web browser.) But, certificates signed before that date are still accepted.

Mozilla Firefox announcement: https://blog.mozilla.org/security/2015/10/20/continuing-to-phase-out-sha-1-certificates/
Google Chrome announcement: http://blog.chromium.org/2014/09/gradually-sunsetting-sha-1.html
Microsoft announcement: http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx

Web Gateway will issue certificates for websites that are SSL scanned, so the signing date will be after January 1, 2016.

Oplossing

Ensure that Web Gateway does not use SHA-1 in the SSL scanning settings (use SHA-256 instead). If you migrated from older Web Gateway versions to newer Web Gateway versions, this setting is not updated automatically.

Log on to the Web Gateway user interface.
Navigate to Policy, Settings, Engines, SSL Client Context with CA.
For all settings containers for SSL Client Context with CA:
1. From the Digest drop-down list, select sha256.
2. From the RSA server key size drop-down list, select 2048.

In addition, if the Certificate Authority (CA) used in Web Gateway was signed using SHA-1, consider replacing it soon. Currently web browsers display a warning only if the web server certificate is signed using SHA-1. But, the same issue might happen eventually for CA certificates signed using SHA-1.

Talen:

Dit artikel is beschikbaar in de volgende talen:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Woordenlijst met technische termen

Termen in woordenlijst markeren

Bekijk onze Woordenlijst met technische termen.

Knowledge Center

Browser certificate warning when you visit HTTPS websites if Web Gateway is using the SSL Scanner with content inspection

Omgeving

Probleem

Oorzaak

Oplossing

Talen:

Woordenlijst met technische termen

Title

Title

Knowledge Center

Browser certificate warning when you visit HTTPS websites if Web Gateway is using the SSL Scanner with content inspection

Omgeving

Probleem

Oorzaak

Oplossing

Talen:

Woordenlijst met technische termen

Kies uw regio

Title

Title