FortiGate, FortiProxy.

By default, FortiGate (up to v7.0.4)/FortiProxy will allow TLS 1.0 (or SSL) via SSL certificate or deep inspection.

It is possible to block insecure TLS/SSL connections via the command 'set unsupported-ssl block'.

Here is an example:

config firewall ssl-ssh-profile
    edit "test"
        config https
            set ports 443
            set unsupported-ssl block <----- Default action: bypass.
        end
  end

Note:

• FortiGate has this option available only for deep-inspection profiles.
• The unsupported versions are hardcoded up to v7.0.4, where it is adjustable via new CLI syntax:

config firewall ssl-ssh-profile
    edit "test"
        config https
            set status deep-inspection
            set unsupported-ssl block (new default)
            set min-allowed-ssl-version tls-1.1 (new option, default value is 'tls-1.1')

        end
end

Related article:

config firewall policy
    edit 0
        set srcintf "Internal"
        set dstintf "Internet"
        set srcaddr "10.10.10.0/24"
        set internet-service enable
        set internet-service-id 10617015 65539
        set status enable
        set schedule "always"
        set logtraffic all
        set logtraffic-start enable
        set ssl-ssh-profile "test" <-- Assign the SSL inspection profile.
end

 
Refer to the logs below: The user's machine sends a Client Hello packet using an unsupported TLS version (TLS 1.0), and the traffic is subsequently blocked by the firewall.

Logs from the firewall :

itime=1724345144 date="2026-02-26" time="16:45:44" devid="FG1K5Dxxxxxx" vd="Internet" type="utm" subtype="ssl" action="blocked" bid=866508801 devname="Cluster01" dstcountry="United States" dstepid=101 dsteuid=3 dstintf="VLAN2998" dstintfrole="wan" dstip="17.248.228.69" dstport=443 dstuuid="191a5502-cb54-51e5-b289-a80bbe7e6668" dvid=12737 epid=3 euid=16572 eventsubtype="unallowed-version" eventtime=1724345144533790755 eventtype="ssl-negotiation" hostname="gateway.icloud.com" id=7406006000496414264 level="warning" logid="1702062101" logver=700120523 msg="SSL connection is blocked." policyid=2 policytype="policy" poluuid="b88741b8-fa81-51ed-aea4-8f264482257d" profile="test" proto=6 service="HTTPS" sessionid=4106711563 srccountry="Reserved" srcintf="VLAN-2188" srcintfrole="lan" srcip="10.10.10.117" srcport=50223 srcuuid="b5a1aff4-10c4-51e7-7f96-1309c7ae5146" tz="+0000" user="MAYUR"

Related documents:

SSL traffic over TLS 1.0 will not be checked and will be bypassed by default

Changes in CLI

Technical Tip: How to block lower TLS version for pass-through traffic