Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

HSTS Errors. VPN sites (ExpressVPN, Nord, etc) not accessible

mcaouettemcaouette Newbie ✭
in Firewall Security Services

Using Sonicwall NSA 4600. Trying to access these sites with Firefox, Chrome, or Brave results in this error below.

Sonicwall logs show no issues. Disabled App Control with no change.

These sites work when I'm out of the office.

Thanks for any help

Your connection is not private

Attackers might be trying to steal your information from www.expressvpn.com (for example, passwords, messages, or credit cards). Learn moreNET::ERR_CERT_AUTHORITY_INVALID

www.expressvpn.com normally uses encryption to protect your information. When Brave tried to connect to www.expressvpn.com this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be www.expressvpn.com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Brave stopped the connection before any data was exchanged.

You cannot visit www.expressvpn.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

Category: Firewall Security Services
Reply

Answers

  • BWCBWC Cybersecurity Overlord ✭✭✭

    @mcaouette are you using Client DPI-SSL on your NSA 4600? This might be the reason and the sites in question do need an exception.

    The sites might work if you properly deployed the DPI-SSL CA Cert, but certificate pinning etc will break it.

    --Michael@BWC

  • mcaouettemcaouette Newbie ✭
    https://community.sonicwall.com/technology-and-support/discussion/comment/15686#Comment_15686

    Yes, Client DPI-SSL was activated, though I only had one IP address listed in the Include column of the Objects section, so I expect Client DPI-SSL would not affect other than that IP, which wasn't being used anymore.

    This definitely puts me on a better path to finding the issue and I will update when I have.

    Thanks BWC

Sign In or Register to comment.