Skip to main content
ricardok
ricardok
New Member
June 28, 2017
Question

SSL VPN to internal site: SSL_ERROR_SSL

  • June 28, 2017
  • 1 reply
  • 6404 views

Dear Fortigate Users, We have to give an internal Application (website) to externals users. For that, we use fortigate 100D, with SSL VPN and WebMode. Because of some security issues we had to update our fortigate to version v5.2.11,build754 (GA). After that, the fortigate doesn't allow anymore the SSL Certifikate  and shows the error: [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1) [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1) [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1) The application is hosted by a cooperate partner and will be closed in a couple of months, So, they won't renew the cert. But, for the externals it is important, to have access to this page. My question: is there a possibility to allow this cert? I tried to insert the website to "SSL/SSH Inspection" as an "Exempt from SSL Inspection" and included ssl inspection to the firewall rule, but it didn't work. Thank you for some hints

    1 reply

    EMES
    EMES
    New Member
    June 29, 2017

    Was SSL/SSH Inspection profile configured on policies or did you just try to add them? If you create a policy allowing any any using no security profiles does it work? Can you possibly add a screen shot of the certificate error the users are seeing?

    ricardok
    ricardokAuthor
    New Member
    June 29, 2017

    I created a Insepction Profile and added the internal page as "Exempt from SSL Inspection". After that, I included this Profile into the IPv4-Policy, which allows the the Webbased SSL VPN users to access the page.

    We also tried give access to some other internal pages with the same rule without problems.

    Our users get the normal (browser-)message, that the page (SSL VPN Portal) is not reachable, but only when they try to open the page with the old cert. They have access to all other pages by the portal. It is the same configuration.

    The only helpfull debug Ican see, I posted in my starting post:

    [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1)

     

    EMES
    EMES
    New Member
    June 29, 2017

    If you remove the inspection profile then SSL Decryption of that traffic stops. if you do that and the problem continues then it may not be the decryption try removing all profiles and test. Maybe another proxy process in the fortigate is stepping on the traffic.

    Terms & ConditionsAccessibility statement