HTTPS inspection with 3rd party certificate shows browser error

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk98025
Technical Level
Product	Application Control, URL Filtering, Security Gateway
Version	R75, R76, R77, R77.10, R77.20, R77.30, R80.10, R80.20, R80.30, R80.40
Date Created	05-Jan-2014
Last Modified	11-Feb-2020

Symptoms

When using HTTPS inspection with 3rd party imported certificate from a trusted CA, browser shows URL mismatch address error.
Errors on different browsers:.

Internet Explorer - "The name on the security certificate is invalid or does not match the name of the site" / "The security certificate presented by this website was issued for a different website's address."

FireFox - "You have attempted to establish a connection with "www.site.com". However, the security certificate presented belongs to "paypal.com.phishingsite.com". It is possible, though unlikely, that someone may be trying to intercept your communication with this web site.
If you suspect the certificate shown does not belong to "www.site2.com", please cancel the connection and notify the site administrator." /

Chrome - “This is probably not the site you are looking for!”
The ‘"Issued to" value’ on the certificate is different from the URLl that was requested

Cause

When using HTTPS inspection, the firewall acts like a "man in the middle" and folds the SSL session into two sessions, one between client-firewall and one between firewall-site.

To perform these actions, the firewall presents the certificate that was configured on the HTTPS inspection on the gateway object.

In some cases, the wrong type of certificate is imported to the firewall, e.g. a certificate that was issued to a single host, and not a sub-CA certificate or Root CA certificate that is allowed to issue certificates for various URLS.

When the client is trying to access some HTTPS website and the firewall presents a certificate that was issued to another host (e.g certificate for www.checkpoint.com when the site is www.gmail.com), the browser will be able to validate the certificate, but will display an error that there is a mismatch between the URL and the certificate host attribute.

Solution

Note: To view this solution you need to Sign In .