Skip to main content
CAD
CAD
New Member
February 25, 2016
Solved

Certificate issue

  • February 25, 2016
  • 2 replies
  • 33054 views

Hello,

i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found  error  below:

"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1".

 

what should to do to solve this issue ?

 

thanks

    Best answer by Ricardo_Tomas

    Hello,

     

    My guess is your unit is doing ssl offload to do one or more security features (IPS or Application control or HTTPS inspection or Antivirus or web filter or explicit proxy) , using an men in the middle approach. That’s fine, it is the common solution.

    Some type of ssl old versions have been depreciated and chrome is giving warnings about that. With time, it will start to block it, forcing a manual override.

    The problem is the certificate that forti unit is giving to the browser is using that old ssl version.

    To resolve it, you need to put a new one with a newer ssl version in forti unit and in the pc’s.

    The easier path is to upgrade the forti unit, since the newer versions have latest ssl version, and then reuse the GPO to put the newer certificate in all pc’s (no problem leaving the old one).

     

    One last thing, both things have to be done at the same time, since you only have the certificate after the upgrade, and you will only have the clean https after the computers have the gpo with the certificate (before, you will have a nasty certificate not trustiest)

    2 replies

    emnoc
    emnoc
    New Member
    February 25, 2016

    What error are you getting specifically ? And yahoo.com does not use a  SHA1 certificate btw?

     

    I bet you have a proxy inserted and your getting that error/warning due to the proxy certificate.

     

     

    CAD
    CADAuthor
    New Member
    February 25, 2016

    Hello, I've mentioned error above between quote, in fact, is not the fault meaning mistake only a red cross on the word (HTTPS :) in the address bar. Yes, we have an proxy, but we use it for other purposes.

     

    thanks.

     

    emnoc
    emnoc
    New Member
    February 25, 2016

    Check the  website via a external site if suspect the site is not sha1

     

    e.g

     

    [link]https://shaaaaaaaaaaaaa.com/check/[/link]

    http://sha1affected.com/

     

     

    Than check your browser and/or  proxy for rejection or warning for sha1.

     

    https://www.elie.net/blog/security/19.5-percent-of-https-sites-trigger-browser-warning-as-they-use-sha-1-signed-certificates

     

    I'm on  chrome 48 and it will warn with a "click" box,firefox  44.0.2 doesn't care.

     

    Ken

    sgroulx
    sgroulx
    New Member
    March 7, 2016

    If you are configured in explcit proxy, update your fortigate to 5.2.6

    CAD
    CADAuthor
    New Member
    March 8, 2016

    Hi, 

    I do not use explicit proxy option.

     

    Really i need your assistance.

     

     

    thanks

    Ricardo_Tomas
    Ricardo_TomasAnswer
    New Member
    March 9, 2016

    Hello,

     

    My guess is your unit is doing ssl offload to do one or more security features (IPS or Application control or HTTPS inspection or Antivirus or web filter or explicit proxy) , using an men in the middle approach. That’s fine, it is the common solution.

    Some type of ssl old versions have been depreciated and chrome is giving warnings about that. With time, it will start to block it, forcing a manual override.

    The problem is the certificate that forti unit is giving to the browser is using that old ssl version.

    To resolve it, you need to put a new one with a newer ssl version in forti unit and in the pc’s.

    The easier path is to upgrade the forti unit, since the newer versions have latest ssl version, and then reuse the GPO to put the newer certificate in all pc’s (no problem leaving the old one).

     

    One last thing, both things have to be done at the same time, since you only have the certificate after the upgrade, and you will only have the clean https after the computers have the gpo with the certificate (before, you will have a nasty certificate not trustiest)

    Terms & ConditionsAccessibility statement