SSL Error accessing web sites after ESA installed in macOS device

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

macOS users accessing internet sites via Cloud SWG using WSS Agent.

With WSS Agent starting the end of life process, security team wanted to test the new Symantec Endpoint Security Agent (ESA) on macOS.

After using an MDM to push the ESA out to a number of macOS devices, each user testing the new code reported experiencing SSL errors accessing secure web sites via Cloud SWG. This was never reported by any of the WSS Agent users.

Environment

macOS.

Endpoint Security Agent.

MDM.

Cause

Broadcom does not install the Cloud SWG CA certificate with the macOS ESA client.

Resolution

Use an MDM to explicitly deploy the Cloud SWG CA certificate to all macOS devices before installing the ESA agent.

Additional Information

Historically MDMs were used to install root certificates on IOS devices, and not macOS devices. With macOS devices "the situation on macOS is more nuanced" as per this Apple response.

"Historically you could do this with keychain APIs. However, we’ve (/ Apple) since added security hardening that prevents this."