After upgrading to firmware version 7.6.4 or above, the GUI may display an 'ERR_CONNECTION_REFUSED' error as shown in the image below:
In the sniffer output below, it is possible to see that the firewall is sending the RST packet in response to the SYN (connection initiation).Â
 diagnose sniffer packet any "host 10.2.2.1 and port 443 " 4 0 l
interfaces=[any]
filters=[host 10.2.2.1 and port 443 ]
2026-02-04 14:38:20.133931 port1 in 10.2.2.1.58189 -> 10.1.1.1.443: syn 3366770127
2026-02-04 14:38:20.134024 port1 out 10.1.1.1.443 -> 10.2.2.1.58189: rst 0 ack 3366770128
2026-02-04 14:38:20.387212 port1 in 10.2.2.1.63535 -> 10.1.1.1.443: syn 3710423967
2026-02-04 14:38:20.387296 port1 out 10.1.1.1.443 -> 10.2.2.1.63535: rst 0 ack 3710423968
In FortiOS v7.6.4 and later, a new internal daemon, 'http_authd', is responsible for centralized GUI authentication and authorization. Refer to the release notes for more information Enhance administrative authentication and session monitoring 7.6.4.
Take the output below:
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application http_authd -1
diagnose debug enable
 To stop the debugging:  diagnose debug disable
diagnose debug reset
Output of debug commands:
 [http_authd 10524 - 1770282285 info] http_authd_handler_main_loop[790] -- Received "validate session" request (seq: 41672) from local (109 bytes)
[http_authd 10524 - 1770282285 info] http_authd_request_handler[612] -- ===============================================
[http_authd 10524 - 1770282285 info] authorize_trusted_request[600] -- Setting local process (Node.JS) login context.
[http_authd 10524 - 1770282285 error] authorize_trusted_request[684] -- Failed to create http_authd session for fabric trusted access from local: Failed to delete admin DB entry.
[http_authd 10524 - 1770282285 info] http_authd_request_handler[630] -- Successfully handled "validate session" request.
[http_authd 10524 - 1770282285 info] http_authd_request_handler[669] -- -----------------------------------------------
[http_authd 10524 - 1770282287 info] http_authd_cleanup_task[171] -- Failed to run GUI session DB cleanup.
 The above debug analysis confirmed that 'http_authd' is failing to create GUI sessions.
Additionally, verify the 'http_authd' session list using the command below:
 diagnose http_authd session list
http_authd session list
[]
 As shown above, no 'http_authd' sessions are currently being created.
Resolution: This issue can be fixed by restarting the 'http_authd' process. To restart the process, use the methods below: diagnose sys process pidof http_authd
Example:
quark-kvm72 (VDOM_Policy) # diagnose sys process pidof http_authd
2071
2085
 diagnose sys kill <pidof>
 Example:
diagnose sys kill 11 2071
diagnose sys kill 11 2085
If multiple processes are present, the above command shows that it needs to be repeated for every PID. Â To kill all the PIDs of the http_authd process at once, the following command can be executed:Â Â fnsysctl killall http_authd
 If the issue is still present after restarting http_authd, check the system event logs for malicious/brute force attempts regarding FortiGate admin login. Once confirmed, proceed to disable the HTTPS access from the public-facing interface.    config system interface
    edit <external-interface-name>
    unset allowaccess
  end
Note: In FortiOS v7.6.6, http_authd may use high memory if multiple unauthorized attempts target a public-facing interface. The best practice is to disable HTTPS on the outside interface. If this cannot be implemented, restrict administrative access using a local‑in policy and trusted host configuration. More guidance on hardening administrative access is available here: Technical Tip: System administrator best practices for FortiGate and FortiProxy.
 Related articles: Troubleshooting Tip: Memory Conserve Mode after upgrading to FortiOS v7.6.6 due to large number of 'http_authd' daemons Technical Tip: In FortiOS 7.6.4 and later, administrator web authentication is handled by the http_authd process | 
