Skip to main content
grasent
grasent
New Member
July 29, 2022
Question

Invalid SSL Cert Only Blocked When IPS Profile Active

  • July 29, 2022
  • 4 replies
  • 2376 views

I am new to FortiGate and struggling to understand the SSL/SSH Profile functionality.

 

If I understand correctly, the SSL Certificate Inspection (Not fully proxy) has the ability to block invalid and/or expired certificated. However, based on my testing, this only functions correctly if the matching policy has an associated IPS policy (protect client in my case).

 

I cannot find any documentation that explains why this is the case, but have tested multiple times and regardless of the configuration, the SSL profile will never enforce block actions unless an IPS profile is present.

 

Version: FortiGate-VM64 v7.2.0,build1157,220331 (GA.F)

 

4 replies

Anthony_E
Staff
Anthony_E
Staff
July 31, 2022

Hello grasent,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Best Regards
Anthony_E
Staff
Anthony_E
Staff
August 4, 2022

Hello,

 

We are still looking for an answer to your question.

We will come back to you as soon as we got one.

 

Regards,

Best Regards
Anthony_E
Staff
Anthony_E
Staff
August 9, 2022

Hello,

 

I have found this old Forum post:

 

https://community.fortinet.com/t5/Fortinet-Forum/7-0-4-break-Proxy-inspection/m-p/203875

 

Where you can find some information. Could you please tell me if it helps?

 

Regards,

Best Regards
grasent
grasentAuthor
New Member
August 9, 2022

Hi Anthony,

 

Thanks for continuing to look into this! Unfortunately I don't think this describes my problem. I have tested this with both flow and proxy mode for the IPS/SSL profile and the result is the same either way.

Terms & ConditionsAccessibility statement