ERR_PROXY_CERTIFICATE_INVALID

Discuss and get help configuring CacheGuard to protect Web end-users
Post Reply
Fortify_MikeK
Posts: 4
Joined: 15 Jul 2021 19:44

ERR_PROXY_CERTIFICATE_INVALID

Post by Fortify_MikeK » 15 Jul 2021 19:48

We are trying to configure CG in non transparent mode. When doing so we get the following error: ERR_PROXY_CERTIFICATE_INVALID as well as no internet traffic through browser. Please help.

User avatar
david
Posts: 163
Joined: 08 Aug 2015 20:38

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by david » 15 Jul 2021 20:32

Hi,

Thank you for your post.

Can you please let us know the following:
  • Your client OS?
  • Your client browser & version?
Did you activate the SSL mediation mode? To know if the SSL Mediation mode is activated or not please use the following command from the CLI:

Code: Select all

mode sslmediate
Best Regards,
David Jan
CacheGuard Technical Team
https://www.cacheguard.com

User avatar
david
Posts: 163
Joined: 08 Aug 2015 20:38

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by david » 15 Jul 2021 20:50

Hi,
Can you also please provide with the website that you are trying to browse via CacheGuard proxy?
Thanks in advance,
David Jan
CacheGuard Technical Team
https://www.cacheguard.com

Fortify_MikeK
Posts: 4
Joined: 15 Jul 2021 19:44

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by Fortify_MikeK » 16 Jul 2021 12:46

SSLMediate is off
Running Windows 10 Chrome Browser - similar issues with IE and FF.
Trying to hit all websites but to test we just did google.com

User avatar
david
Posts: 163
Joined: 08 Aug 2015 20:38

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by david » 16 Jul 2021 12:56

Can you hit an HTTP (not S) website such as http://www.example.com to check network connectivity please ?

Do you have any other security devices in front of your CG? If so, can you please check that they don't block Web traffic and/or make SSL inspection by generating dynamic certificates?

Please send us the output of the following commands:

Code: Select all

ip
ip route
port
In your browsers, what IP address and port do you use for the proxy configuration?

Best,
David Jan
CacheGuard Technical Team
https://www.cacheguard.com

Fortify_MikeK
Posts: 4
Joined: 15 Jul 2021 19:44

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by Fortify_MikeK » 16 Jul 2021 14:56

Http trafic through http://neverssl.com does not work either - I get err_proxy_connection_failed

User avatar
david
Posts: 163
Joined: 08 Aug 2015 20:38

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by david » 16 Jul 2021 15:26

(for security reasons I deleted the links that reveal your public IP addresses - below your IP configuration)

Code: Select all

ip internal 10.11.3.3 255.255.255.0
ip external xxx.xxx.xxx.107 255.255.255.248

ip route 10.10.20.0 255.255.255.0 10.11.3.254 10
             192.168.254.0 255.255.255.0 10.11.3.254 10
             default xxx.xxx.xxx.105 50
  • From your CG can you ping your default gateway (xxx.xxx.xxx.105)?
  • From your CG can you ping cacheguard.net?
  • From your client (windows) can you ping your CG internal IP address (10.11.3.3)?
  • What is your client (Windows) IP address?
Please ensure that your Chrome browser uses the 10.11.3.3 IP on 8080 port as the proxy.

Best Regards,
David Jan
CacheGuard Technical Team
https://www.cacheguard.com

Fortify_MikeK
Posts: 4
Joined: 15 Jul 2021 19:44

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by Fortify_MikeK » 16 Jul 2021 16:22

From your CG can you ping your default gateway (xxx.xxx.xxx.105)? - Yes we can
From your CG can you ping cacheguard.net? Yes we can
From your client (windows) can you ping your CG internal IP address (10.11.3.3)? Yes we can
What is your client (Windows) IP address? 10.11.3.8

Some one had told me to set the port to 8090 - thats when get the ERR_Proxy_Certificate_Invalid. Now that I changed it to 8080 I get ERR_Proxy_Connection_Failed

User avatar
david
Posts: 163
Joined: 08 Aug 2015 20:38

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by david » 16 Jul 2021 18:10

The default proxy port is 8080. The 8090 port is the default Web GUI administration port.

Please double check that 10.11.3.3:8080 is used as HTTP, HTTPS and FTP proxy. Also Chrome under a supported desktop environment (such as Windows) uses the system proxy settings. Did you setup the proxy configuration at the Windows level?

Do you have the same error with Firefox?
Can you hit the http://10.11.3.3 URL?

Please send us the output of the following command:

Code: Select all

system report link
Tip: you can activate the SSH server on your CG using the following commands:

Code: Select all

admin ssh on
apply force
And then connect to your CG using an ssh client (like putty) --> You can use Copy/Paste in an SSH client window to send the output of the command above.

Best,
David Jan
CacheGuard Technical Team
https://www.cacheguard.com

User avatar
david
Posts: 163
Joined: 08 Aug 2015 20:38

Re: ERR_PROXY_CERTIFICATE_INVALID

Post by david » 17 Jul 2021 16:43

Hi,

It is also possible that you didn't connect the right CG ports to your other network devices. The following command gives you the association between physical (Ethernet) ports and logical interfaces:

Code: Select all

link bond
You can use it to identify ports on your CG. Please note that the internal interface should be connected to you LAN (clients side) and the external interface should be connected to your internet router (or frontal firewall).

Best Regards,
David Jan
CacheGuard Technical Team
https://www.cacheguard.com

Post Reply