Skip to main content
veechee
New Member
October 18, 2010
Question

" The server certificate validation failed"

  • October 18, 2010
  • 2 replies
  • 3745 views
On my public WiFi, I received a strange error today. There was a user or two visiting that had pop3s and imaps configurations in their clients (not sure if it was off a smartphone or a laptop). The FGT is blocking these connections with this type of error: 1 2010-10-18 17:23:52 log_id=12553 type=webfilter subtype=urlfilter pri=notice vd=root policyid=3 identidx=0 serial=288874 src=" <removed>" sport=57062 src_port=57062 src_int=" vlan_publicwifi" dst=" <removed>" dport=993 dst_port=993 dst_int=" wan1" service=" imaps" msg=" The server certificate validation failed" profile=" public_wifi" 2 2010-10-18 17:23:22 log_id=12553 type=webfilter subtype=urlfilter pri=notice vd=root policyid=3 identidx=0 serial=288836 src=" <removed>" sport=49225 src_port=49225 src_int=" vlan_publicwifi" dst=" <removed>" dport=995 dst_port=995 dst_int=" wan1" service=" pop3s" msg=" The server certificate validation failed" profile=" public_wifi" I use FortiGuard web filtering, but have no custom url white lists, black lists, or content lists. I searched the documentation and the only reference I can find to this error refers to a banned word list filter. That is not applicable in this case. Does anyone know what checkbox in either FortiGuard Web Filter or Advanced Options would be causing this obviously invalid cert to cause a block? I like that the FGT can do this, but for public access I don' t really care that the cert is invalid and would prefer the visitor can get their email instead of being blocked.

    2 replies

    Carl_Wallmark
    New Member
    October 19, 2010
    Hi, There is a checkbox under Firewall -> Protocol Options -> " your profile" You need to check the box to allow invalid certificates...
    veechee
    veecheeAuthor
    New Member
    October 19, 2010
    I checked and I have the box to allow invalid SSL certificates checked for every protocol. I also have the box checked to log invalid SSL certificates though, so I think in this case the traffic wasn' t being blocked, rather, the invalid certificate was being logged every time it was used.