Troubleshooting Tip: FortiWeb 'SSL Error (339) – no renegotiation' after upgrading to v7.6.x

Description

This article describes the cause of 'SSL Error (339) – no renegotiation' on FortiWeb after upgrading to FortiWeb v7.6.x and describes how to restore backend connectivity.

Scope

FortiWeb v7.6.x and above.

Solution

After upgrading FortiWeb to version 7.6.x, all backend SSL connections may fail, and FortiWeb may log repeated SSL Error (339) – no renegotiation messages.

No configuration changes are required on the client or backend server side for this behavior to appear. This behavior is expected after upgrading to FortiWeb v7.6.x and is not indicative of configuration loss or system failure.

Starting with FortiWeb v7.6.x, the SSL library was upgraded from OpenSSL v1.1.x to OpenSSL v3.0. OpenSSL v3.0 enforces stricter TLS security by disabling legacy TLS renegotiation by default. If a backend server relies on TLS renegotiation (for example, during client-certificate–based authentication flows), FortiWeb will terminate the backend connection, resulting in SSL Error (339).

When this issue occurs, FortiWeb logs typically show backend TLS sessions being established, followed by backend-initiated connection resets and renegotiation errors.

To allow backend servers that require TLS renegotiation, disable the no-renegotiation restriction on the affected server pool. Run the following CLI commands:

config server-policy server-pool
    edit <affected_server_pool>
        config pserver-list
            edit 1
                set ssl-noreg disable
            next
        end
    next
end

After applying this change, backend SSL connections should be restored.

Security impact:
This setting affects only the FortiWeb-to-backend (server-side) TLS connection. Client-side SSL security and inspection behavior remain unchanged.

Additional notes:

• The same configuration may work on FortiWeb v7.4.x because OpenSSL v1.1.x allowed legacy renegotiation by default.

• The CLI option ssl-noreg may not appear in tab completion in some FortiWeb v7.6.x builds, but it is valid and functional when entered manually.

• This behavior change is tied to the SSL library upgrade and not to FortiWeb policy or profile changes.