Explorer

Solved

Intermediate certificate

Forum|Forum|2 years ago
July 13, 2023
7 replies
34107 views

Hi,

I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".

I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

Best answer by serveradmin

Hi,

FYI, I downgraded fortios to 6.4.14 and it works! So it seems like it is bug in FortiOS 7.4.0. I will check if the same problem is also on fortios 7.2.5

abarushka

Staff

Hello,

As far as I understand FortiGate is not sending certificate chain. If I understand correctly I would recommend to check whether all intermediate certificates in the chain are imported to FortiGate (GUI: system - certificates).

serveradminAuthor

Explorer

Done it as well. Both under Remote CA Certificates and Remote Certificates. Any other ideas?

abarushka

Staff

Hello,

Please make sure that root CA is imported under Remote CA Certificates.

You may also consider to reboot FortiGate, clear the browser cache and try to navigate to the web-site and check in the browser whether full chain is sent.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-avoid-certificate-error-message-by-chaining/ta-p/196605

ebilcari

Staff

The error says that the intermediate is missing or is not the right one? There are some cases when you still have a valid Intermediate certificate listed in your trust chain but the intermediate certificate is not the right one (Cross-Signing). Modern browsers tend to auto correct this behavior and you don't get any warnings, some other systems are not that friendly with it.

You can test the same chain of certs you have uploaded in FGT to another web server or check the certificate chain files with openssl tool:

openssl verify -CAfile RootCert.pem -untrusted Intermediate.pem UserCert.pem

Emirjon

serveradminAuthor

Explorer

This is how it looks like.

ebilcari

Staff

From the snapshot it looks like the intermediate certificate is completely missing.

Can you run the ssl tool somewhere and check with this command:

openssl s_client -connect www.test.eu:443 <--replace the domain here

It will give more details for the Certificate chain presented by FGT

Emirjon

serveradminAuthor

Explorer

As I posted earlier I have already done that. Intermediate certificate is uploaded to Fortigate. Root is also present and .pfx is uploaded as bundle of certificate, intermediate etc.

nobox

New Member

I have the same problem on 7.4 but I discovered that after changing the policy to Flow-based, the certificate is sent in its entirety along with the intermediate one, this is not a solution, but rather a workaround, but always something

daniels7

New Member

We experience the same issue on 7.4 as well. The workaround with using Flow-based instead of Proxy-based works but the Bug should be fixed soon

JasoSmit1

New Member

I'm running FortiOS 7.2.6 and had this same issue with the sslvpn site and a GoDaddy (Starfield) intermediate CA certificate. I inadvertently resolved it while adjusting ciphers to improve SSL Report score from the great Qualys SSL Labs. I'm not sure why the settings below worked or if applicable to a virtual server but the Fortigate now sends the full certificate chain (and increased my report score from B to A+).

config vpn ssl settings
set banned-cipher RSA DHE DSS CAMELLIA 3DES SHA1 STATIC ARIA AESCCM
set ciphersuite TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-CCM-SHA256

set dtls-min-proto-ver dtls1-2

end

Update:

After removing the config I added above the issue remains fixed. It is possible that just adding the intermediate CA is insufficient to fix the issue which also requires the webserver to restart in order see the added certificate. This is based on the assumption that modifying the vpn ssl settings caused the webserver to restart and see the ICA was present.

eriksornes

Explorer

I'm runnig fortigate 7.4.9 with fortimangaer 7.4.8 and @JasoSmit1 exact settings worked for me. Now the whole of the sslvpn certifcate chain is passed through. Now there are no untrusted certificate warnigns and also openssl s_client connect server.domain:port returns whole chain. Before on 7.4.9 it was problem. No certificate chaing with openssl s_client connect (only host certificate) and "untrusted certificate"-warning with forticlient (7.4.3 on ubuntu 22.04/24.04 and android). Thanx alot. I opened a supportcase with Fortinet on this, and will report the findings and refer to this post.

I have not currently tried to reset the settings. We also have another environment with same problem on fortigate 7.2.12, but in fear of disconnecting users, changes there must wait a few weeks.

5Lights

New Member

done suppose you got anywhere with this?

EHoegee

Explorer

Well they fixt it on 7.4.10 and also list it there as a bug fix.

However they did not list this as a bug on previous versions. I did ask the engineer to do this.

Did head a session with Fortinet and turns out that they released Fortios 7.4.10 in the release note's it is listed as a bug that is fixt on the release:
https://docs.fortinet.com/document/fortigate/7.4.10/fortios-release-notes/289806/resolved-issues

Bug ID Description
1197212, WAD incorrectly prioritizes the default FortiGuard CA bundle over user-installed CAs when building certificate chains for cross-signed server certificates.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded