HTTPS GUI access fails on FortiGate v7.6.5 while SSH remains accessible

Description

An issue occurs where GUI access to a FortiGate running v7.6.5 is lost without any configuration changes. However, SSH access to the device continues to function normally.

Scope

FortiGate v7.6.5.

Solution

Administrators may be unable to access the GUI using either the internal or external IP address of the FortiGate. However, SSH access works as expected.
The issue occurs without any configuration changes.

The same behavior is observed when using different certificates, including:

• Fortinet_Factory.

• Fortinet_GUI_Server.

• Self-sign.

Changing the HTTPS management port does not resolve the issue.

The following crashes may be observed in the diagnose debug crashlog read output.

1212: 2026-01-13 11:11:53 <00233> Node.JS restarted: (unhandled rejection)
1213: 2026-01-13 11:11:53 <00233> "Failed to get token."
1214: 2026-01-13 11:11:53 <00233>
1215: 2026-01-13 11:11:53 <00233> Node.JS restarted: (unhandled rejection)
1216: 2026-01-13 11:11:53 <00233> "Failed to get token."
1217: 2026-01-13 11:11:53 <00233>
1218: 2026-01-13 11:11:53 <00233> Node.JS restarted: (unhandled rejection)
1219: 2026-01-13 11:11:53 <00233> "Failed to get token."
1220: 2026-01-13 11:11:53 <00233>
1221: 2026-01-13 11:11:53 <00233> Node.JS restarted: (unhandled rejection)
1222: 2026-01-13 11:11:53 <00233> "Failed to get token."

No output is seen in the httpsd debug output of diagnose debug application httpsd -1 when attempting to access the GUI of the FortiGate.

• Restarting the httpsd process does not resolve the issue.

fnsysctl killall httpsd

• CPU and memory utilization is normal on the FortiGate.

get sys performance status

• No local-in policies are configured that would block GUI access.

config firewall local-in-policy
show full

Starting with FortiOS 7.6.4, a new internal daemon called http_authd has been introduced. This daemon centralizes the administrative web authentication and authorization functions required by web service processes.

After upgrading to FortiOS 7.6.4, administrators may notice a new process named http_authd appearing in system process listings, such as diagnose sys top or fnsysctl ps.

For troubleshooting administrator web login issues in 7.6.4 and later, the following debug commands can be used to view authentication-related logs:

diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application http_authd -1
diagnose debug enable

To stop debugging, run the following commands:

diagnose debug disable
diagnose debug reset

Packet capture confirms that the FortiGate receives the TCP SYN packet for GUI access, but the FortiGate immediately responds with a TCP RST.

It is also observed that a TCP socket was not opened for the httpsd process.

5.587905 mgmt in 172.29.126.87.49777 -> 172.29.200.231.44445: syn 589825187
5.587990 mgmt out 172.29.200.231.44445 -> 172.29.126.87.49777: rst 0 ack 589825188 

diagnose sys tcpsock | grep httpsd

Note:

Check both IPv4 and IPv6 TCP socket tables for the configured administrative HTTPS port before concluding that the listener is missing:

diagnose sys tcpsock
diagnose sys tcpsock6

No matching entry in the IPv4 table alone is insufficient to conclude that the HTTPS listener is absent.

This behavior indicates that the TCP socket for the httpsd process is not successfully opened, resulting in the connection being reset by the FortiGate.

This issue has been resolved in:

• v7.6.7

• v8.0.0

Workaround:

It is recommended to first attempt clearing the administrative sessions.

Restarting the http_authd process has been found to be effective in mitigating the issue temporarily.

If the issue persists, reboot the FortiGate to restore GUI access or upgrade the firmware to a fixed versions via the CLI:

• Technical Tip: How to upgrade FortiGate firmware (Specifically, see the 'Upgrading the firmware through the CLI' section).

• Technical Tip: Multiple ways to list and disconnect administrators logged in to a FortiGate