Certificate error for isolated websites with Chrome version 105 or later.

Products

• Web Isolation Cloud
• Web Isolation Cloud

Issue/Introduction

When accessing isolated websites through web isolation, the following error is seen

• This is seen for all websites
• The websites open when using Chrome 104 and below and when using internet edge
• The CA certificate of the web isolation tenant/device is already installed in the trusted root certificate authority store of the local machine

Environment

Web isolation cloud tenants

Cause

• In the latest versions, Chrome is now using their own CA store and have added a certificate verifier. Refer https://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html and https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md
• This will affect older WI tenants as their CA was generated a long time ago and will fail the certificate verification due to it containing an invalid format.
• Also, this will come into picture only if self signed CA is used

Resolution

Broadcom is working on identifying such affected tenants and fixing the CA certificate

Currently, there are two workarounds.

1. Simply revert the Chrome version to 104 or older OR
2. Upgrade to Chrome version 105 and above and disable it via the flag OR
   
   chrome://flags
   search for "Chrome Root Store"
   set to disable
   restart Chrome using the relaunch button

Customers are advised to raise a technical support case with Broadcom.