New Member

Question

PCI Non Compliance HTTP/1.0 Protocol Downgrade Detected

Forum|Forum|5 months ago
December 31, 2025
10 replies
5296 views

How do I Configure server to reject HTTP/1.0 requests with "505 HTTP Version Not Supported" status and enforce minimum HTTP/1.1 protocol version? I am using Fortigate 60f and I need to make necessary changes so that my Merchant Service PCI Compliance passes. This is the last setup that I need and would like to make the fix with GUI, not CLI. Any help would be great appreciated.

Toshi_Esumi

SuperUser

One of our customers reported the same pentest failed report due to the same "HTTP/1.0" issue (the report says HTTP/1.1 is still unacceptable, while only HTTP/2 and /3 are acceptable) against their VDOM serving SSL VPN with 7.2.12. Since I couldn't find a good way to "silence" this, we opened a TAC case 10 days ago. TAC's initial response was:
"The reported behavior has been escalated to our PSIRT team, and we are currently awaiting a status update. Any feedback received from then will be shared through this ticket."
And, we still haven't gotten any update from them yet. Since they didn't come back and say "you have to upgrade to 7.4.x or 7.6.x", I'm assuming upgrading it to a newer generation wouldn't resolve this issue.

Toshi

Toshi_Esumi

SuperUser

We just got an update from them via the ticket. It says:
"... our development team is currently working on a fix for the reported issue under bug#1240901..."
Not sure this bug ID is directly for this particular issue. But at least implementing a change or changes to address this issue. In other words, it wouldn't be resolved until a new release(s) with this fix comes out.

Toshi

ag5

New Member

Is there an update on this issue? We are experiencing the same issue. We are running on a Fortigate 400F ver7.2.11 Build 1740. Thanks

TMalik

New Member

Just had our monthly Pen test fail on the same issue. HTTP/1.0 Protocol Downgrade Detected found at PORT: 10443. v 7.0.18 build 0695. 200E

Any update from the PSIRT team?

Sandman7391

Explorer

Same issue here. “HTTP/1.0 Protocol Downgrade Detected found at PORT: 443”

100f v7.4.9 build2829.

Matt_B

Staff & Editor

Qualsys added and updated some signatures in November 2025, see QID 530600 in their bulletin here https://notifications.qualys.com/product/2025/11/28/application-security-detections-published-in-november-2025.

SSLVPN/Agentless VPN on all current FortiOS versions including v7.2.12, v7.4.9, and v7.6.5 would be affected by the signature change and start to show warnings on any PCI Compliance scan using Qualsys or tools with similar signatures.

While 1240901 is an internal issue number requesting an update to SSL VPN to allow blocking HTTP/1.0 requests, there is no current schedule to include a fix in v7.2 or v7.4. If there will be a FOS-side change to resolve the fix these branches, it is likely not soon. I mention those branches specifically since SSL VPN tunnel mode is removed in FortiOS v7.6.3 SSL VPN tunnel mode replaced with IPsec VPN.

For any of my customers who are able, I'm recommending expedited migration to IPsec VPN in order to disable SSL VPN and avoid this issue. Obviously that's not an appropriate solution for all environments.

Is it a bug, is it a feature? It's... not in spec!

cvc_lukes

New Member

My scan reported the same thing. So looking to see if there might be an ETA to Fortinet rolling a fix as I know removing SSL VPN isn't exactly an option for my company at this time.

Toshi_Esumi

SuperUser

We got an update on our ticket saying it would be in "7.4.11(no ETA), 7.6.6(ETA-April), 8.0.0(ETA-March)".

Since 7.4.10 just came out yesterday, 7.4.11 would be like 3-4 months away. 8.0.0 might be the first to be available. But then SSLVPN wouldn't work for 7.6.6 and 8.0.0 anyway.
So FTNT really wants everybody out of SSLVPN, I guess.

Toshi

cvc_lukes

New Member

Thanks. I got the same response with my ticket too.

mike_stegge

New Member

If you are hosting a webserver behind a FortiGate.

Create an IPS signature

F-SBID(--attack_id 9999; --name "Block_HTTP_1.0"; --protocol tcp; --flow from_client; --pattern "HTTP/1.0"; --service HTTP;)

Add that to your Intrusion Protection

Configure that under your destination virtual server on the Firewall policy page

gt57

Visitor III

If PCI compliance is your only pentest, could you NAT your PCI device(s) to another, external IP address that is not used by SSL/WEB VPN and have your PCI compliance only check that address?

jeff363Author

New Member

Logically that sounds like an alternative action but as far as I can tell, I only have one external IP address, which comes from the modem. I’m not overly savvy with network connection so if there’s another way of creating a alternate external IP address to use, I’d love to learn

gt57

Visitor III

Check with your ISP regarding getting a second IP address. You can map this IP address to the internal IP address of the PCI device(s).

If you are unsure how to configure NAT in the Fortigate, I would recommend enlisting a FortiGate consultant to do this for you.

Additionally, you could put your PCI device(s) on a separate, isolated VLAN if not already. I am not a PCI expert but exposing your PCI devices to your LAN probably violates something.

Another solution, which would require a 2nd IP address is to put another, low-end firewall dedicated for PCI that would not have the SSL/WEB VPN. Essentialy build a separate network for PCI.

DgtlScott

New Member

Has anyone confirmed if the rushed 7.4.11 contains the fix for this. I read the release notes and did not see anything jump out for this. Assuming this may have been a rush release just for the other CVE so may not have all the other fixes etc.

DKLNTN

New Member

I am using 7.4.11 on a 80F and it failed last night.

jerrygail1

New Member

Same here. I upgraded to 7.4.11 yesterday, rescanned today and it failed with the http/1.0 issue.

Sircle_Network

New Member

Yesterday we ran new PCI DSS scans, and without having done anything, the HTTP 1.0 non-compliance for the Fortinet VPN client is no longer present. Do you know if Qualys or some other tool has removed these checks and made them non-mandatory for PCI DSS? I haven't found any official communication from Fortinet or Qualys.

gt57

Visitor III

Are you able to run curl on the outside interface?

curl -I -k --http1.0 https://<IP>:<port>

Here is how mine respond:

Bad: SSL VPN enabled on this IP and Port
C:\>curl -I -k --http1.0 https://<IP.219>:<PORT>
HTTP/1.0 200 OK
Date: Tue, 24 Mar 2026 18:22:44 GMT
ETag: "xx-xxxxxxxx"
Accept-Ranges: bytes
Content-Length: 131
Connection: close
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'; object-src 'self'; script-src 'self' https: 'unsafe-eval' 'unsafe-inline' blob:;
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000

Good: SSL VPN not enabled on this IP and Port
C:\>curl -I -k --http1.0 https://<IP.220>:<PORT>
curl: (28) Failed to connect to x.x.x.220 port xxxx after 21058 ms: Could not connect to server

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded