Add subordinate and root CAs for TLS traffic

This example shows how to generate the Certificate Signing Request (CSR) in Sophos Firewall and the subordinate Certificate Authority (CA) in Active Directory Certificate Services (AD CS) in Enterprise CA mode.

Alternatively, you can use a third-party tool, such as OpenSSL, to generate the CSR and CAs. You must upload subordinate and root CAs generated through third-party tools on Certificates > Certificate authorities. See Add a CA.

You can use the subordinate CA as the signing CA for SSL/TLS inspection, HTTPS decryption, and TLS configurations for emails.

Do as follows:

1. Generate a CSR.
2. Generate a subordinate CA and download the subordinate and root CAs.
3. Import the subordinate CA to Sophos Firewall.
4. Upload the root CA to Sophos Firewall.
5. Apply the subordinate CA.

Generate a CSR

1. Go to Certificates > Certificates and click Add.

2. For Action, select Generate certificate signing request (CSR).

   

3. Specify the following Certificate details:

   1. Enter a name.
   2. Key type (example: RSA)
   3. Key length (example: 2048)

   4. Secure hash (example: SHA - 256)

      Here's an example:

      

4. Specify the following Subject name attributes:

   1. Country name (example: United States)
   2. State (example: Georgia)
   3. Locality name (example: Atlanta)
   4. Organization name (example: Example organization)
   5. Organization unit name (example: IT)
   6. Common name (example: www.exampleorg.com)

   7. Email address (example: email@exampleorg.com)

      Here's an example:

      

5. For Subject Alternative Names, enter DNS names or IP addresses.

   Examples: web.exampleorg.com, fd12:3456:789a:1::, 203.0.113.10

   

6. Click Save.

7. Download the CSR as follows:
   1. Click the download button for the CSR you created.

   2. In the pop-up window, click Copy to clipboard.

      Here's an example:

      

Generate a subordinate CA in Active Directory Certificate Services

You must generate a subordinate CA based on the CSR. This example uses AD CS in Enterprise CA mode.

1. In AD CS, do as follows to generate a subordinate CA.

   1. Click Request a certificate.

      

   2. Click Advanced certificate request.

      

   3. Paste the CSR certificate you copied.

   4. For Certificate template, select Subordinate Certification Authority.

   5. Click Submit.

      Here's an example:

      

   6. Under Certificate Issued, select an encoding format.

      This example selects the Base 64 encoded format.

   7. Click Download certificate to download the subordinate CA certificate.

      

2. Do as follows to download the root CA certificate:

   1. On the welcome page, click Download a CA certificate.

      

   2. Select the root CA that's used to sign the subordinate CA.

   3. Click Download CA certificate.

      Here's an example:

      

   4. Click Save.

Import the subordinate CA to Sophos Firewall

For CAs generated based on a CSR you created on Sophos Firewall, you must import the CA as follows:

1. Go to Certificates > Certificates and click Add.
2. Click the import button for the CSR you generated.
3. Click Choose file and select the subordinate CA you downloaded from AD CS.

4. Click Certificate authority only.

   The firewall recognizes that it's a CA and makes the CA options available.

5. Change the certificate authority name if you want.

6. Click Import certificate.

   Here's an example:

   

7. To see the subordinate CA on the list, go to Certificates > Certificate authorities.

8. Use the filter next to Name, enter the search term for the CA's name, and click Apply.

   Here's an example:

   

   You can see the subordinate CA you imported. The firewall automatically associates the CSR's private key with the subordinate CA.

   

Upload the root CA to Sophos Firewall

To trust the subordinate signing CA, you must upload its root CA to Sophos Firewall.

1. Go to Certificates > Certificate authorities and click Add.
2. For Certificate, click Browse and upload the root CA you downloaded from AD CS.
3. Change the name if you want.

4. Under Use certificate for, retain the following default selection: Validation.

   The root CA only validates the subordinate CA you imported.

   Here's an example:

   

5. Click Save.

Apply the CA

You can select the subordinate CA to re-sign SSL/TLS traffic.

• See Configure SSL/TLS inspection and decryption.

  To make sure the subordinate and root CAs are in use for web traffic, open an HTTPS website, click the padlock icon, and check the secure connection details.

• See Use Sophos Network Agent for iOS 13 devices.

• See Email general settings.