Skip to main content
romank
Explorer III
March 21, 2024
Question

FortiWeb - SNI settings

  • March 21, 2024
  • 2 replies
  • 1674 views

Hello,

Gotta question regarding ssl certificate and SNI configuration. Im gonna use SNI solution, do I need to setup "certificates" on main page when creating main policy? please see screenshot. From my point of view no, cuz all certs info will be pointed in SNI policy, but I wannabe sure. I did test scenario where I put  a cert there and SSL Labs showed me some errors, and sometimes I was getting "pr_end_of_file_error" - but im not sure if this was cuz of this. 

 waf1.png

2 replies

AEK
SuperUser
SuperUser
March 21, 2024

Hi Romank

Used it few years ago so if I'm not wrong the Certificate field should be the default one it the requested domain name is not in the SNI. I'll try to double check this info.

AEK
shafiq23
Staff & Editor
Staff & Editor
April 5, 2024

Hello romank,

 

You can leave it blank as Client Hello contains SNI that would match domain name in the SNI policy associated in server policy.

 

"pr_end_of_file_error" error seems surrounding on TLS problem. You can try to enable only TLS 1.2 and 1.3 and test again.

 

Thanks.

 

Regards,

Shafiq

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!