I can't find where in Windows Server 2012 R2 you can export a "key" for the domain's root CA.  Any ideas? ... View more

The CA is Windows Server 2012 R2.  I just don't recall ever seeing anything in one of the certificate mmc snapins to export a key.  I'll poke around on there.   I wish the WSA would just be updated to not require it.  Nothing is broken at all.  We are seeing all the popular https sites all signed by our Domain-CA as the parent, and in the browser its showing it doesn't expire until 2024.  So even though in the WSA it thinks the cert is expired, its still using the new one anyway.   We just wanted to eliminate the alerts so I can turn back on email alerting for critical events for WebProxy. ... View more

See, nobody knows. It doesn't seem well documented. Even TAC is researching because they don't have the answer either. What I really want is to eliminate the requirement of uploading a "key" when just uploading a root ca for trust. ... View more

Before you posted ppreenja, under HAT I created a new AMAZONAWS sender group and added those IP ranges in.  I made the SenderBase reputation score from 0 to 10.  The mail flow policy I created was TLSREQUIRED which basically REQUIRES TLS (drop if it doesn't).  My thought was I figured if the sender used TLS and it had a 0 to 10 SBRS score, it should help somewhat from bad guys who don't thoroughly pay attention to all of the details spinning up spam or phishing email servers in AWS.   This seemed to work.  But then today even though it seemed that email was working fine... two vendors inquired via Skype for Business about email bounce backs (Our organization rejected the message).  Looking through some message logs it seemed like every email was being detected and applied to the AMAZONAWS sender group, even if the IP address DID NOT MATCH the 4 CIDR IP addresses.  The HAT overview screen was in this order: 1 CISCO_CRES     TLSREQUIRED 2 RELAYLIST     RELAYED 3 WHITELIST     TRUSTED 4 BLACKLIST     BLOCKED 5 SUSPECTLIST     THROTTLED 6 AMAZONAWS     TLSREQUIRED 7 ACCEPT-TLS     ACCEPTED 8 UNKNOWNLIST     ACCEPTED ALL     ACCEPTED   So this time I tried reordering it like so: 1 CISCO_CRES     TLSREQUIRED 2 RELAYLIST     RELAYED 3 WHITELIST     TRUSTED 4 BLACKLIST     BLOCKED 5 SUSPECTLIST     THROTTLED 6 ACCEPT-TLS     ACCEPTED 7 UNKNOWNLIST     ACCEPTED 8 AMAZONAWS     TLSREQUIRED ALL     ACCEPTED   I sent a test email from my gmail account and in the message logs it detected it as ACCEPT-TLS sender group.  I also had a vendor resend me an email that was "rejected by our organization" and it now came through this time (they are not using Amazon AWS either).  Now I don't have an Amazon AWS email system I can test to see if that is detected properly, but does anyone know what is going on?  Will my reordering work? Yes ppreenja, you have a full understanding of our rule.     Here is the text based filter we have when I SSH to the ESA and view it: (since this is a publicly accessible forum I changed our actual domain name in here to simply domain.) 1 Y Y Anti-Spoofing Anti-Spoofing: if sendergroup != "RELAYLIST|WHITELIST|AMAZONAWS" { if (header("from") == "(?i)@domain\\.com") OR ((mail-from == "(?i)@domain\\.com") OR ((header("from") == "(?i)@domain\\.org") OR (mail-from == "(?i)@domain\\.org"))) { quarantine("Spoofed"); } }    ... View more

Hi I need Patch 6, where is the download?  I can't find it in Cisco's search box for software downloads, and its not under the Security category.   Does anyone have a link?   ... View more