SSL warning for a valid certificate with captive portal login

Question

Hi everyone.

So I set up a policy based captive portal authentication (not configured at interface level). I forced HTTPS login page, assign an authentication certificate (a valid GlobalSign wildcard certificate for *.unap.cl) and set authentication redir-url. Like this rule.

edit 77
        set uuid 1b9dfbee-18c8-51e8-b78f-0e0dacfd03c9
        set srcintf "IntRed-NoSegura"
        set dstintf "port17"
        set srcaddr "Red_10.39.204.0"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set groups "WiFI2"
        set comments "CP TEST - Salida Internet ENTEL"
        set global-label "Internet - DMZ - MPLS"
        set auth-cert "*.unap.cl"
        set auth-redirect-addr "fap-cp-test.unap.cl"
        set nat enable
next

It normally works fine witch Firefox web browser (tested under linux and windows), but with Chrome, Edge, IE and Android Web Browser I get the "unsafe site warning".

Really don't know why this happen and really don't know if is a Fortigate issue.

Pleas advise on where to look for solution.

Thanks

emnoc · Accepted Answer

So in the unap cert do you have the intermediates? What I would do from a curl standpoint

Cat the root/intemediates for the issues and install into curl an into the windows ( assuming windows ) and then retest on windows and the machine with curl

In curl it these

CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs

IIRC cat the root/intermediate for issues and dump it into ca-certificate.crt 

example on macosx

cp /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt_ ; 

Cat the caroot and intermediates and then cat that biig file into the ca-certificates


cat mynewcaandintermediates >> /etc/ssl/certs/ca-certificates.crt ;

Then retest with curl? Does you warning go away ?

Ken

reference this https://superuser.com/que...authority-ca-to-ubuntu

Fishbone_FTNT · Answer

Hi UNAP,if that works in FF, I assume redirection is setup properly from your side. Meaning you have properly setconfig user setting   set auth-ca-cert <SSL-inspect-CA-cert> end If I am right, then the issue could be caused by the fact that Chrome (and possibly also others nowdays) require to have original site FQDN in SAN DNS name, in the cert which is present in the inspected connection redirecting traffic to the portal. FF still seems to not require this, Chrome started to require this some time ago (q4 2018 iirc). You can check actually, once you get cert warning. Display certificate and look for SANs. If the original site's FQDN is not there, it's likely the cause.You would need to go for at least to upcoming 5.4 or 5.6 release to fix this.  5.2 is not planned to be fixed, if I look correctly.6.0.1, 5.6.4 and 5.4.9 will contain the fix for issue I've described (tracked by our bug #0457883). Of course my advice is quite a guess, you would need to share with me more information to really be sure. Fishbone)( EDIT: fixed some html escaped garbage

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded