Howto add new certificate authorities?

[eelsasser]

If you have a 6.x configuration with your desired CAs in it already, you can use the listConverter to export and re-import the whole list to MWG7.

i just don't have a way to merge a list of new CAs into an existing set of CAs for 7. I guess I could write a tool

[Former Member]

maybe i made something complete wrong but:

with this config

and these lists

where is my mistake?

[asabban]

Hi northalpha,

the error message claims that the RootCA which signed the certificate for www.bund.de is not in the list of known CAs on your MWG7 configuration. Did you ensure the CAs are in your list of known RootCAs?

Unfortunately I cannot see this in the Screenshots.

Best,

Andre

[Former Member]

yes, you are right after importing TCTrustCenterClass2CAII.crt and TCTrustCenterClass2L1CAXI.crt it is working, but to be honest: why change the builtin way to "add CAs" as in the 6.8 Webwasher releases? It was more user friendly than copy and importing by yourself ...

[asabban]

Hi northalpha,

are you talking about the "Inspect certificate" feature in MWG6? The dialogue that presented you with the RootCAs and showed which were denied/allowed?

I agree this was very comfortable. We have something similar for adding certificates to the "Certificate White List", but that does not allow to add RootCAs.

We are working on improving the RootCA experience in the future by having it a list that dynamically updates, so most likely you will not need to manually touch the list in the future. Only for very few RootCAs a manual import may be required, for example for your own, internal CA.

I assume this will be a much better implementation in the future, but at the moment it is - I agree - not the easiest way if importing RootCAs.

Best,

Andre

[Troja]

Hi Andre,

i get error messages from the rule engine when using the CA List from WW6

An internal error occured while processing your request.

URL: https://www.xing.com/
URL Categories: Professional Networking
Current Rule ID: 18068
Current Rule Name: Block Expired Server (7 Day Tolerance) and Expired CA Certificates
Error Message: (10056) Internal rule engine error: property is in unexpected state.

Company Acceptable Use Policy

This is an optional acceptable use disclaimer that appears on every page. You may change the wording or remove this section entirely in index.html.Client IP: x.x.x.x User Name:ts Request Protocol and Version: HTTP/1.1 Response Protocol and Version: Authentication Realm: MYDOMAIN IsAuthenticated: true Authentication Method:NTLMURL Categories: Professional Networking URL Host: www.xing.comBody File Name: Body ClassID: Media Type (enshured): application/x-empty Media Type (from Header): Media Type (is supported): false Rule Name: Block Expired Server (7 Day Tolerance) and Expired CA Certificates Rule ID: 18068 Response.Redirect.URL: URL: https://www.xing.com/ Cacheable: false Cache Status: TCP_MISS Rule.FiredRule.Names: Bypass ePO Requests, Header Modifications, Global Block, Global Whitelist, SSL Scanner, Handle CONNECT Call, Set Client Context, Enable Certificate Verification, Default, Block on Antimalware Engine errors, Block on All Errors, Ignore COACHING: untrusted CAs, Authentication (Direct Proxy), Authentication, Authorize, URL Filtering, URL Filter Rules, Enable SafeSearchEnforcer, Common Rules, Web Cache, SPP: Skip Requests That Do Not Carry Information, Enable Opener, Enable Composite Opener, Media Type Filtering, HTML Filtering, Remove Content-Encoding header, Gateway Antimalware, Remove Partial Content for HTTP(s) Requests, Global Block, Global Whitelist, SSL Scanner, Certificate Verification, Default, Block on Antimalware Engine errors, Block on All Errors, Always Block

[asabban]

Hi Thorsten,

that sounds odd. I have just tried to replicate this but I am unable to. What I have done is

- import the XML via Rule Set Library -> Import from File

- Save Changes

- Go to Settings -> Certificate Chain -> Default, change the list from the original list to the newly imported one

- Save again

It seems that the first rule that tries to utilize the list of certificates causes an error. Is there anything in one of the error logs maybe?

Best,

ANdre

[Troja]

Hi Andre,

yes, i did it nearly in the same way.

- imported the xml file

- saved the configuration

- changed the "List of certificate authorities" directly in the rule set

- saved the configuration

- disabled any rule where the CA list is used. (when changing back MWG was only working fine after disable/enable any rule where the CA list was used)

I also enabled/disabled the rules step by step. Andre you are right. Any rule where the imported ca list ist used is not working any more.

I will take a look tomorrow.

Cheers,

Thorsten

[asabban]

Good point 🙂

I have attached an XML which contains the RootCAs as they come with a blank 6.9 installation. You can import the list via the Rule Set library. Thorsten, maybe you want to have a look into the list?

Hint: I have NOT tested this but it looks good. After import you may need to touch the SSL Scanner Ruleset and point it to the correct list of RootCAs!

Best,

Andre

Nachricht geändert durch asabban on 21.07.11 08:35:01 CDT

[Troja]

Hi Andre,

perfekt, i will take a look in this ruleset 🙂

cheers,

Thorsten