Technical Tip: Block non-HTTPS traffic masquerading as HTTPS with unsupported SSL negotiation checks

Description

This article describes how to block non-HTTPS traffic that attempts to masquerade as HTTPS by using TCP port 443, even when the traffic is not performing a valid SSL/TLS handshake

Scope

FortiGate.

Solution

Attackers may intentionally use TCP port 443 to carry protocols other than HTTPS, such as FTP, SSH, Telnet, or random TCP payload sent over port 443 in an attempt to bypass security controls that commonly allow HTTPS traffic.

The unsupported-ssl-negotiation option handles non-SSL/TLS traffic masquerading as HTTPS, while tunnel-non-http option handles non-HTTP traffic masquerading as HTTP, to validate HTTP protocol compliance.

When deep inspection is enabled, FortiGate expects traffic on an HTTPS service port to start with a valid SSL/TLS handshake. If the traffic does not contain a valid TLS negotiation, FortiGate attempts to parse the SSL/TLS negotiation and discovers that the handshake is invalid and it can be either bypassed or blocked depending on the unsupported-ssl-negotiation option in SSL/SSH inspection profile.

Configuration:

config firewall ssl-ssh-profile
    edit "custom-deep-inspection"
        config https
            set ports 443
            set status deep-inspection
            set unsupported-ssl-negotiation block
        end
        set ssl-negotiation-log enable
    next
end

config log setting
    set expolicy-implicit-log enable
end

• When unsupported-ssl-negotiation is set to allow, the WAD process identifies the traffic as an unexpected protocol and bypasses inspection:

[I]2026-08-04 20:53:16.660393 [p:3763][s:25964]      wad_ssl_proxy_srv_on_malformed_input:11814 sp=0x7fb24d8b63f0/6 malformed input state=0
[I]2026-08-04 20:53:16.660394 [p:3763][s:25964]      wad_ssl_proxy_srv_unexpect_bypass :11643 wsp=0x7fb24d8b63f0/6, unexpected bypass state=0 compliant=0.
[I]2026-08-04 20:53:16.660396 [p:3763][s:25964]      wad_ssl_proxy_bypass              :4920  sp=0x7fb24d8b6048/7 bypassing=0 cache=0!
[W]2026-08-04 20:53:16.660398 [p:3763][s:25964]      wad_ssl_proxy_can_bypass          :4857  sp=0x7fb24d8b63f0/6 reason=unexpect_protocol action=1.bypass

The session is then forwarded through the proxy and the SSH connection remains established.

• When unsupported-ssl-negotiation is set to block, using the same SSH-over-443 test traffic, the WAD process identifies the unexpected protocol and blocks the connection:

[I]2026-08-04 20:57:04.325747 [p:3763][s:26210]      wad_ssl_proxy_srv_on_malformed_input:11814 sp=0x7fb24d8ef3f0/6 malformed input state=0
[I]2026-08-04 20:57:04.325748 [p:3763][s:26210]      wad_ssl_proxy_srv_unexpect_bypass :11643 wsp=0x7fb24d8ef3f0/6, unexpected bypass state=0 compliant=0.
[I]2026-08-04 20:57:04.325758 [p:3763][s:26210]      wad_ssl_proxy_bypass              :4920  sp=0x7fb24d8ef048/7 bypassing=0 cache=0!
[W]2026-08-04 20:57:04.325761 [p:3763][s:26210]      wad_ssl_proxy_can_bypass          :4857  sp=0x7fb24d8ef3f0/6 reason=unexpect_protocol action=3.block

The SSL negotiation is terminated and the TCP session closes immediately.