SuperUser

Solved

Source IP for cert probe

Forum|Forum|1 month ago
July 13, 2026
6 replies
85 views

Hi FGT admins

FortiOS 7.4.12. All HTTPS sited are blocked with error: “SSL connection is blocked due to unable to retrieve server's certificate”.

In the latest FOS updates the FGT probes the certificate itself (self generated traffic) before allowing or denying the traffic, right.

I checked this tech tip and I know we can change cert-probe-failure as workaround.

But I my case I know the issue is caused by my WAN interface having one primary private IP and one public IP as secondary IP (ISP constraint). I had to change source-ip for many services like DNS and FortiGuard in order to make them reachable. But can’t find similar source-ip for certificate probe traffic.

I know one other workaround is to make public IP primary and private IP secondary but I prefer avoid this change in case there is “source-ip” customization for cert probe.

Any useful info would be appreciated.

Best answer by funkylicious

indeed it says about an ipsec example, but i think that you can test it also since it wont really ‘hurt’ anything and due to having a more unique scenario.

also i would also give this a try

funkylicious

SuperUser

try

"jack of all trades, master of none"

AEKAuthor

SuperUser

Thanks Funkylicious for your feedback.

It seems this is IPsec related, right? If so then this is not really what I’m looking for.

AEK

funkyliciousAnswer

SuperUser

indeed it says about an ipsec example, but i think that you can test it also since it wont really ‘hurt’ anything and due to having a more unique scenario.

also i would also give this a try

"jack of all trades, master of none"

sjoshi

Staff

Hi @AEK

Have you tried below changes.

config ips global

config tls-active-probe

set source-ip (set public IP here)

end

did it worked?

Also can you confirm if any of the policy are in proxy mode where certificate inspection is enabled?

Thanks, Salon

AEKAuthor

SuperUser

Thank you @funkylicious and @sjoshi ,

I’ll try each method and let you know.

AEK

AEKAuthor

SuperUser

Thanks to both. That was the right fix.

Ps: It seems we cannot mark more than one response as “Best answer”, so I mark the first one provided by Funkylicious.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO