Skip to main content
ronen_beitelmajer
New Member
Jul 22, 2025 12:42 PM UTC
Question

Virtual Server with HTTPS healtcheck failing TLS verification

I am running a Virtual server on my Fortigate 1500D with the following healtcheck:

config firewall ldb-monitor     edit "PatroniMaster"         set type https         set interval 10         set timeout 2         set retry 3         set port 8008         set src-ip 0.0.0.0         set http-get "/master"         set http-match "200 OK"         set http-max-redirects 0     next end

The healtcheck is polling a Patroni service that runs with HTTPS with certificates signed by a private CA.

The private root CA has been loaded to the Global scope of the Fortigate for trust purposes.

The healtcheck is failing due to certificate verification issues.

 

Tried a few different setups:

1. Server certificate without chain

2. Server certificate with chain

3. Root CA with and without intermediate CA

 

Tested the Patroni solution with curl from a remote PC and it works as expected:

curl -k $PATRONI_HOST/replica --> returned: curl: (60) SSL certificate problem: unable to get local issuer certificate curl -k --cacert $PATH_TO_ROOT_CA $PATRONI_HOST/replica --> returned: 200 OK

 

Some logs from diagnose:

ipldbd::http_send_url(595): HTTP send() failed. errno=5 ipldbd::epoll_mod_event(67):modify epoll event failed! fd=19 errno=9 ipldbd::http_send_url(570): HTTP send get-url="GET /master HTTP/1.1 User-Agent: FortiGate (FortiOS 7.0) Chrome/ Safari/ Cache-Control: no-cache Pragma: no-cache Host: $PATRONI_HOST:8008 Keep-Alive: timeout=15 Connection: Keep-Alive Content-Length: 0  " ipldbd::http_handle_get_response(526): recv failed mon=PatroniMaster errno=5

 

Would appreciate some help

Thanks

3 replies

filiaks1
Explorer III
Jul 22, 2025 3:15 PM UTC

I think the only way could be to use HTTP health monitor and on the backend servers to allow only the fortigate IP address to connect on HTTP. Could not see an option to stop the cert verification for a HTTPS health monitor.

Translate
ronen_beitelmajer
New Member
Aug 3, 2025 7:25 AM UTC

I tend to agree, although it seems to be like an moderately easy fix, given that Fortigate already supports the use of private CAs for many TLS features. 

 

Eventually, I changed Patroni to work with HTTP only and added a username:password for API requests. Also allowed networking from the Firewall itself.

Translate
filiaks1
Explorer III
Aug 4, 2025 9:40 PM UTC

I am not a Engineer working directly for Forti but seems that just the option is not exposed. 

Translate
Risk and Resilience in the Age of AI. An OT Thought Leadership Summit for Houston's Critical Infrastructure Leaders. Date: Thursday, December 3, 2026. Time: 8:30 am - 1:30 pm (CT). Location: The Westin Houston, Memorial City | 945 Gessner Road, Houston, TX 77024