Skip to main content
ronen_beitelmajer
New Member
July 22, 2025
Question

Virtual Server with HTTPS healtcheck failing TLS verification

  • July 22, 2025
  • 3 replies
  • 648 views

I am running a Virtual server on my Fortigate 1500D with the following healtcheck:

config firewall ldb-monitor     edit "PatroniMaster"         set type https         set interval 10         set timeout 2         set retry 3         set port 8008         set src-ip 0.0.0.0         set http-get "/master"         set http-match "200 OK"         set http-max-redirects 0     next end

The healtcheck is polling a Patroni service that runs with HTTPS with certificates signed by a private CA.

The private root CA has been loaded to the Global scope of the Fortigate for trust purposes.

The healtcheck is failing due to certificate verification issues.

 

Tried a few different setups:

1. Server certificate without chain

2. Server certificate with chain

3. Root CA with and without intermediate CA

 

Tested the Patroni solution with curl from a remote PC and it works as expected:

curl -k $PATRONI_HOST/replica --> returned: curl: (60) SSL certificate problem: unable to get local issuer certificate curl -k --cacert $PATH_TO_ROOT_CA $PATRONI_HOST/replica --> returned: 200 OK

 

Some logs from diagnose:

ipldbd::http_send_url(595): HTTP send() failed. errno=5 ipldbd::epoll_mod_event(67):modify epoll event failed! fd=19 errno=9 ipldbd::http_send_url(570): HTTP send get-url="GET /master HTTP/1.1 User-Agent: FortiGate (FortiOS 7.0) Chrome/ Safari/ Cache-Control: no-cache Pragma: no-cache Host: $PATRONI_HOST:8008 Keep-Alive: timeout=15 Connection: Keep-Alive Content-Length: 0  " ipldbd::http_handle_get_response(526): recv failed mon=PatroniMaster errno=5

 

Would appreciate some help

Thanks

3 replies

filiaks1
Explorer III
July 22, 2025

I think the only way could be to use HTTP health monitor and on the backend servers to allow only the fortigate IP address to connect on HTTP. Could not see an option to stop the cert verification for a HTTPS health monitor.

ronen_beitelmajer
New Member
August 3, 2025

I tend to agree, although it seems to be like an moderately easy fix, given that Fortigate already supports the use of private CAs for many TLS features. 

 

Eventually, I changed Patroni to work with HTTP only and added a username:password for API requests. Also allowed networking from the Firewall itself.

filiaks1
Explorer III
August 4, 2025

I am not a Engineer working directly for Forti but seems that just the option is not exposed. 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.