SSL Certificate Inspection causing connection issues with certain sites

Question

We have SSL Certificate Inspection enabled (we are NOT using DPI-SSL, so we don't have the MITM invalid certificate problem).  Certain services such as Amazon Echo, credit card POS devices, and PRTG application updates error out on connection with this enabled.  If I simply remove the certificate inspection from the IP4 rules everything works.  Are there any tweaks that will make just the services we're having trouble with connect?  I know with DPI-SSL you can set exclusions, but that option doesn't seem to be available for the certificate inspection option.  As a secondary question, what exactly is the Fortigate doing during certificate inspection that breaks these services?

hmtay_FTNT · Accepted Answer

Hello,

To answer daccu's question first,

Certificate Inspection should not break any SSL connections. The Fortigate only inspects the SNI on the Client Hello or the Server Certificate when Certificate Inspection is used. It does not attempt a MitM. Could you post the output of the CLI commands, "config firewall ssl-ssh-profile", "edit <your profile>", "show"?

E.g.

edit "certificate-inspection" set comment "SSL handshake inspection." config https set ports 443 set status certificate-inspection end config ftps set ports 990 set status disable end config imaps set ports 993 set status disable end config pop3s set ports 995 set status disable end config smtps set ports 465 set status disable end config ssh set ports 22 set status disable end next

This is the default certificate-inspection profile.

SteveG,

TLS 1.3 would have affected the engine if you used deep-inspection - not widespread yet, recently added into Chrome 56 (would require the server to support the protocol too). It should not affect it if certificate-inspection is used. Our dev team has released a new engine to address TLS 1.3. It is not released to the public yet as it is undergoing beta tests.

LewisBowerbank,

You can disable the replacement message.

If you are using the Web Filter profile and FortiOS 5.4, here's how:

Go to "config webfilter profile", "edit <profile name>", "set https-replacemsg disable".

If you are using the Application Control profile and FortiOS 5.4,

Go to "config application list", "edit <application name>", "set app-replacemsg disable".

SteveG · Answer

I'm seeing similar stuff on a couple of sites (angular.io), like you if I disable SSL inspection for that site it works fine. Do you have 'block invalid certs' ticked on your SSL Inspection profile, I disabled that but still see the same problem? I'm wondering if it's a TLS 1.3 thing but not had time to investigate fully.

Sign up

Login with SSO

Login to the community

Login with SSO