Technical Tip: AES-256-GCM cipher suite is not advertised when using an EC384 certificate on a VIP object

Description

This article describes an issue where FortiGate aligns the allowed symmetric ciphers with the strength of the certificate key as per the cryptographic guidelines such as RFC4492.

Scope

FortiGate.

Solution

In earlier FortiOS versions, when a VIP configured with an ECDSA P-384 (EC384) certificate, FortiGate does not advertise the TLS 1.3 cipher suite TLS_AES_256_GCM_SHA384. As a result, only TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256 were offered for TLS 1.3 connections. When other certificate types are used, the cipher suite is advertised normally.

config firewall vip 
    edit <name>
        set type server-load-balance
        set ssl-certificate <SSL certificate>
        set ssl-algorithm custom
            config ssl-cipher-suites
                edit 1
                    set cipher TLS-AES-256-GCM-SHA384
                    set versions tls-1.3
                next
                edit 2
                    set cipher TLS-CHACHA20-POLY1305-SHA256
                    set versions tls-1.3
                next
                edit 3
                    set cipher TLS-AES-128-GCM-SHA256
                    set versions tls-1.3
                next
    next
end

The fix is included in the upcoming FortiOS releases v7.4.13, v7.6.8 and v8.0.1, which are not available yet.