Why can I not access websites using SHA1 signed certs while using DPI-SSL?

03/26/2020 66 People found this article helpful 96,501 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

The use of SHA1 signing for SSL certificates has been deprecated since 2016. However, some websites still use Certification Authority certificates that are signed using SHA1. In SonicOS 6.5.4.4 (and security patches) the "Go Daddy Class 2 Certification Authority" certificate (SHA1 signed) has been removed to protect customers from accessing websites that use a deprecated security standard.

Since the Go Daddy certificate (mentioned above) has been removed from SonicOS 6.5.4.4, customers who use DPI-SSL may not be able to access websites that have been signed by the Go Daddy certificate. The resolution below describes how to re-import the "Go Daddy Class 2 Certification Authority" (SHA1 signed) into the firewall in order to access websites using a deprecated signing method.

Resolution

1. Create the "Go Daddy Class 2 Certification Authority" certificate by copying the complete text below into a simple text editor (for example, Notepad):
   -----BEGIN CERTIFICATE-----
MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh
MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE
YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3
MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo
ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg
MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN
ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA
PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w
wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi
EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY
avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+
YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE
sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h
/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5
IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD
ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy
OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P
TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ
HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER
dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf
ReYNnyicsbkqWletNw+vHX/bvZ8=
-----END CERTIFICATE-----
2. Save the file with the .cer extension and ensure that "Save as type" is set to "All Files".
   
3. Login to the SonicWall as an administrator and navigate to MANAGE | Appliance | Certificates.
4. Click Imported certificates and requests and then click Import.
5. Click Import a CA certificate from a PKCS#7 (.p7b), PEM (.pem) or DER (.der or .cer) encoded file and then click Browse and select the .cer file that was created in step 1.
6. Click Import
   

   CAUTION: A reboot is required when handling cryptographic material.

ISSUE ID:

218308

Related Articles

• SSL Control and DPI-SSL Compatibility
• FIPS Mode: Radius protected with IPSEC VPN
• Maximum DHCP Leases

Categories

• Firewalls > NSa Series > Client/Server DPI-SSL
• Firewalls > NSv Series > Client/Server DPI-SSL
• Firewalls > TZ Series > DPI-SSL