Technical Tip: Connectivity Issue with FortiGuard Servers Due to SSL_connect Failure (LENC License)
Description
This article describes the reasons behind the inability to connect to the FortiGuard Server caused by SSL_connect failures.
Scope
FortiGate.
Solution
FortiGate devices operating under a Low Encryption (LENC) license are unable to establish connections with FortiGuard servers.
The LENC license utilizes TLS version 1.0, which is deprecated and no longer supported by FortiGuard Server. As a result, validation attempts are unsuccessful due to the inability to negotiate a more secure encryption cipher with this license.
FortiGate # get sys status | grep License
License Status: Low-Encryption(LENC)
Some LENC devices have the prefix LF in the FortiGate serial number as well. For example: 'LF310BXXXXXXXX' instead of 'FG310BXXXXXXXX'.
In debug logs, error messages similar to the following are observed:
Commands:
diagnose debug reset
diagnose debug application updated -1
diagnose debug console timestamp en
diagnose debug enable
execute update-now
Logs:
upd_vm_process[816]-last warning 8 seconds ago
do_setup[348]-Starting SETUP
upd_fds_load_default_server6[1046]-Resolve and add fds usupdate.fortiguard.net ipv6 address failed.
upd_comm_connect_fds[457]-Trying FDS 209.40.106.61:443
[115] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default)
[484] ssl_ctx_use_builtin_store: Loaded Fortinet Trusted Certs
[504] ssl_ctx_use_builtin_store: Enable CRL checking.
[511] ssl_ctx_use_builtin_store: Enable OCSP Stapling.
[814] ssl_ctx_create_new: SSL CTX is created
[841] ssl_new: SSL object is created
[191] ssl_add_ftgd_hostname_check: Add hostname checking 'usupdate.fortiguard.net'...
[1049] ssl_connect: SSL_connect failes: error:0A00042E:SSL routines::tlsv1 alert protocol version
ssl_connect_fds[391]-Failed SSL connecting (6,0,TLS/SSL connection has been closed)
[206] __ssl_data_ctx_free: Done
To resolve this issue, it is recommended to upgrade to a full, regular license that supports high encryption standards.