Technical Tip: FortiProxy and Explicit Web Proxy resigned certificate do not support CRL

FortiProxy or Explicit Web Proxy is used in order to perform deep packet inspection for traffic going to external sites.

The inspection is performed with a custom CA certificate used in SSL/SSH deep inspection profile.

The issue is that the replacement certificate created by the FortiProxy/Explicit Web Proxy during deep inspection doesn't contain CRL.

As a result, the access to websites is failing.

Using curl will show the following error:

curl -v --connect-timeout 15 -x http://proxy.tech:8080 https://www.heise.de

curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.

Currently, Explicit Web Proxy and FortiProxy resigned certificate do not support CRL.

This feature can be requested by raising a New Feature Request (NFR). Contact a local sales representative to submit an NFR.