website access problems

Question

good afternoon colleagues, a question.In the morning we had some problems with access to some pages that I could access normally.In order to pass the certificate analysis I had to enter the rule and in the SSL INSPETION section change from certificate-inspection to no inspection until the page loads without problems and then return to certificate-inspection.This problem has been occurring with other pages that were previously accessed. the connection is not privateIt is possible that attackers are trying to steal your information from xxxxx.com(for example, passwords, messages or credit cards).NET::ERR_CERT_AUTHORITY_INVALIDIt is worth mentioning that when you enter through another network, for example, a cellular data network or a home network, if you can access the page and the message "it is not secure" does not appear.Do you know why this happens? It is worth mentioning that the certificate of the page expires in 2024 so there should be no problem.

Anonymous_User · Accepted Answer

Hi,

The error message "NET::ERR_CERT_AUTHORITY_INVALID" typically occurs in web browsers like Google Chrome and Mozilla Firefox when there is an issue with the SSL/TLS certificate of a website.

When the browser encounters an invalid certificate authority, it means that the SSL/TLS certificate presented by the website cannot be verified with a trusted certificate authority. There are a few common reasons why this error might occur:

1) Expired or Invalid Certificate: The SSL/TLS certificate may have expired or is otherwise considered invalid by the browser.

2) Self-Signed Certificate: The website is using a self-signed certificate instead of one issued by a recognized certificate authority. Self-signed certificates are not trusted by default in most browsers.

3) Mismatched Domain: The certificate is issued for a different domain or subdomain than the one you are trying to access, causing a domain mismatch.

4) Misconfigured Certificate Chain: The certificate chain provided by the server is incomplete or not properly configured.

5) Untrusted Certificate Authority: The certificate authority that issued the certificate is not recognized or trusted by the browser.

6) Root Certificate Updates: Sometimes, a user's browser may need updates to its root certificate store, which contains the list of trusted certificate authorities.

So, please confirm by installing the certificate on the client machine and allowing it to trust it initially, this will clarify you to narrow down the issue.

Regards,

Kruthi

Anonymous_User · Answer

Hi,

When FortiGate cannot successfully authenticate the server certificate (i.e. untrusted root CA, expired, self-signed certificate) it will present the CA certificate configured via set untrusted-caname in the SSL inspection profile (default CA certificate name: Fortinet_CA_Untrusted).

In some cases, HTTPS websites using server certificates issued by Entrust will encounter an untrusted root CA warning because the specified Entrust root CA certificate in the server certificate's chain of trust is not in FortiGate's Trusted CA list (see Security Profiles -> SSL/SSH Inspection -> View Trusted CAs List on FGT).

The issue is that the HTTP site's server certificate was issued by an intermediate CA associated with a specific Entrust root CA certificate that has been deemed invalid because of an invalid certificate property. Since this Entrust root CA certificate is invalid, it's not trusted by all browsers.

This issue can be confirmed by using the URL of the affected HTTPS site with an online SSL checker website like SSL Labs' SSL Server Test (https://www.ssllabs.com/ssltest/) or SSL Shopper's SSL Checker (https://www.sslshopper.com/ssl-checker.html), and observing the checker's result that the certificate chain is incomplete or the certificate is not trusted in all browsers.

Regards

Priyanka

Sign up

Login with SSO

Login to the community

Login with SSO