Skip to main content
slemke
slemke
Visitor III
April 25, 2017
Question

Problems with "certificate inspection" on Google.com

  • April 25, 2017
  • 2 replies
  • 40292 views

Hello,

 

I have a weird problem with webfiltering, certificate inspection (NOT deep inspection) and google.com on a Fortigate 50E, v5.4.4

 

When I try to open google.com I get an ERR_CONNECTION_CLOSED - on several PCs with FF,IE,Chrome - all the same error; other https sites are working.

Again - I do not have the deep inspection configured only the certificate inspection, therefore I do not have a CA root from the FGT installed (then other websites won´t work as well).

 

When I disable either the ssl inspection or webfilter completely it works. I have tested this also with a FGT60D on 5.4.4 - same error. On the 60D with 5.2.10 everything was fine.

 

The configuration is attached below.

Any ideas, any known bugs?

 

Thanks

Sebastian

 

 

config firewall policy     [...]     edit 22         set srcintf "lan"         set dstintf "wan1"         set srcaddr "PC UTM Temp disabled"         set dstaddr "all"         set action accept         set schedule "always"         set service "ALL"         set utm-status enable         set webfilter-profile "default"         set profile-protocol-options "default"         set ssl-ssh-profile "certificate-inspection"         set nat enable     next       [...] end config webfilter profile     [...]     edit "default"         set comment "default web filtering"         config ftgd-wf             config filters                 edit 1                     set category 2                     set action warning                 next                 edit 2                     set category 7                     set action warning                 next                 edit 3                     set category 8                     set action warning                 next                 edit 4                     set category 9                     set action warning                 next                 edit 5                     set category 11                     set action warning                 next                 edit 6                     set category 12                     set action warning                 next                 edit 7                     set category 13                     set action warning                 next                 edit 8                     set category 14                     set action warning                 next                 edit 9                     set category 15                     set action warning                 next                 edit 10                     set category 16                     set action warning                 next                 edit 11                     set action warning                 next                 edit 12                     set category 57                     set action warning                 next                 edit 13                     set category 63                     set action warning                 next                 edit 14                     set category 64                     set action warning                 next                 edit 15                     set category 65                     set action warning                 next                 edit 16                     set category 66                     set action warning                 next                 edit 17                     set category 67                     set action warning                 next                 edit 18                     set category 26                     set action block                 next             end         end     next     [...] end config firewall ssl-ssh-profile     edit "certificate-inspection"         set comment "SSL handshake inspection."         config https             set ports 443             set status certificate-inspection         end         config ftps             set ports 990             set status disable         end         config imaps             set ports 993             set status disable         end         config pop3s             set ports 995             set status disable         end         config smtps             set ports 465             set status disable         end         set caname "Fortinet_CA_SSLProxy"         set certname "Fortinet_SSLProxy"     next end

    2 replies

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    April 26, 2017

    Hello Sebastian,

     

    You configuration looks fine. Can you send me a packet capture when you try to access the Google site with the issue you are having? I can take a look at the pcap for you to see if the Fortigate tried to intercept the Certificate and potentially other issues. Thanks!

     

    HoMing

    lolaat
    lolaat
    New Member
    April 27, 2017

    Hello

    did you use forticlient?

     

     

    slemke
    slemkeAuthor
    Visitor III
    April 27, 2017

    Good Morning,

     

    I will take a packet trace today or tomorrow. I will send you the download link via pm, ok?

    Forticlient is not being used.

     

    Regards,

    Sebastian

    KordiaRG
    KordiaRG
    New Member
    November 27, 2017

    I had similar issues with 5.4.3 on FG300D.  I upgraded to 5.4.5 and the issues went away.  May or may not be related, but worth getting the latest version.

     

    Rich

    Xpeful
    Xpeful
    New Member
    December 4, 2017

    I got the same problems on our guest-wifi Fortigates without SSL-Inspection. (Fortigate 60D FW 5.4.5)

    We're using a personal guestportal in our LAN. After connecting to the guest SSID the Fortigate redirects to this portal.

     

    If you try to access it via Chrome the problem occurs (similiar to the first one, it says that the connection is unsecure >> only on google sites before redirecting to the guestportal).

    If you try to access it via Samsung Internet Browser >> no problems... 

     

    Any ideas to that case?

    Thanks!

     

    Regards

    Lukas

    Terms & ConditionsAccessibility statement