Skip to main content
sheerazali
sheerazali
Explorer
August 8, 2024
Solved

SSL Certificate Issue on Andriod Application

  • August 8, 2024
  • 3 replies
  • 3056 views

Dear Fortinet Community,

We are deploying a WAF (FortiWeb) in an Environment and Migrating a Web Application behind FortiWeb. We have a dual gateway seanerio in our environment for FortiWeb, for traffic to route its proper destination we used PBR here to route return or response traffic towards it destination.
After all configurations of virtual server, server pool, virtual IPs, server policy, adding certificates of servers in FortiWeb, Migrarted Web Application working properly and doesn't pop-up SSL Certificate error in the browser but on the same Hostname we have an android application of the client , it shows SSL Certificate error on Android Application we open our application. For clarification we called a certificate in Server Policy of FortiWeb for this Service and that certificate is Wild-Card Certificate.
Please suggest is there any configurations missing at our FortiWeb end or something else.

Best answer by shafiq23

Hello @sheerazali,

 

There are some cases where Android device requires complete certificate chain provided by the server(which is FortiWeb). I can see you mentioned a wildcard certificate imported into FortiWeb server policy. Can you also import its intermediate CA, create Certificate Intermediate Group  and define it in the respective server policy.

To upload an intermediate CA’s certificate

https://docs.fortinet.com/document/fortiweb/7.4.4/administration-guide/991825/uploading-a-server-certificate

Thanks.

 

Regards,

Shafiq

3 replies

ozkanaltas
ozkanaltas
Valued Contributor III
August 8, 2024

Hello @sheerazali ,

 

browsers can generally ignore the certificate trust chain, and because of that, you can't be faced with any error on the browser. But, mobile devices not working like this. You need to install an intermediate certificate to FortiWeb.

 

You can review this document on how to install intermediate certificate on FortiWeb.

 

https://docs.fortinet.com/document/fortiweb/7.6.0/administration-guide/991825/uploading-a-server-certificate

sheerazali
sheerazaliAuthor
Explorer
August 8, 2024

Hello @ozkanaltas 

Please find attached snapshot of Web Application and Android Application has same certificate and also imported and attached certificate in the Server Policy in FortiWeb.
Web Application with Secure Connection:
Web-App.png

 


Android App:
WhatsApp Image 2024-08-06 at 10.34.23 PM.jpeg

ozkanaltas
ozkanaltas
Valued Contributor III
August 8, 2024

Hello @sheerazali ,

 

Can you check the certificate details on Chrome your certificates should look like this.

 

 

image.png

 

If your application is accessible from the internet you can test it with this website. This website will tell about SSL certificate problems.

 

https://www.ssllabs.com/ssltest/

 

And also, the TLS version and ciphers are also important for mobile phones. If you use a higher TLS version like TLS1.3 some phones don't like this. You need to require to optimize your cipher and TLS settings for mobile phones.

sheerazali
sheerazaliAuthor
Explorer
August 11, 2024

Hi Community, 

We need to resolve this issue as soon as possible. If anyone has a solution, please share it.

shafiq23
Staff & Editor
shafiq23Answer
Staff & Editor
August 15, 2024

Hello @sheerazali,

 

There are some cases where Android device requires complete certificate chain provided by the server(which is FortiWeb). I can see you mentioned a wildcard certificate imported into FortiWeb server policy. Can you also import its intermediate CA, create Certificate Intermediate Group  and define it in the respective server policy.

To upload an intermediate CA’s certificate

https://docs.fortinet.com/document/fortiweb/7.4.4/administration-guide/991825/uploading-a-server-certificate

Thanks.

 

Regards,

Shafiq

sheerazali
sheerazaliAuthor
Explorer
August 15, 2024

Hi @shafiq23 

 

 

Thank you for your to-the-point response. This is exactly what I was looking for. Yesterday, we successfully imported the CA certificate into the Intermediate CA Group and integrated that Intermediate CA Group into our Server Policy for one of our test environments. Testing is currently underway, and I will update the community on whether it resolved the issue.

 

For reference, I followed the guide from the Fortigate Community for importing CA certificates into the Intermediate Certificate Group:

https://community.fortinet.com/t5/FortiWeb/Technical-Tip-How-to-install-intermediate-certificates-to-avoid/ta-p/195424

Terms & ConditionsAccessibility statement