New Member

Question

When using proxy based UTM profiles I get Certificate Issues

7 replies
1855 views
Translate All

I have been using the proxy based UTM profiles for all our students firewall profiles and have had no issues until last week. We started getting Certificate issues on client devices. such as Err_Cert_date_invalid.

The certificate in question is issued by FortiGate but on inspection it is expired even though the certificate in the Manager is not expired. Im not even sure where to begin with this but it is causing issues as I have had to change to Fow based but this is allowing students to access sites that they shouldn't be despite rules being setup to prevent this.

Regards

abarushka

Staff

Hello,

Could you please clarify whether you are using default built-in certificate or imported CA certificate?

Moreover, I would like to ask whether you are using certificate inspection or deep inspection?

Translate

GenesisTechhubAuthor

New Member

Hi There

We are using the built in Fortinet_CA_SSL Certificate.

Regards

Translate

mriswan

Staff

Hello,
If you FGT is on v7.6, This issue might be related to the certificate manager feature change introduced in v7.6. The new option 'resigned-short-lived-certificate' feature is not working properly with certificate cache-timeout.
Please follow below KB for workaround:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-fix-ERR-CERT-DATE-INVALID-error-for/ta-p/393925

Translate

GenesisTechhubAuthor

New Member

Thank you mriswan.

This has not resolved the issue. I found another customer with the exact same issue

full isnpection problem - Fortinet Community

No solution has yet been offered from Forti.

Translate

mriswan

Staff

Hi, Thank you for reply.

Can you check and change the below setting?

config firewall ssl setting
set cert-manager-cache-timeout 72 <---- adjustable between 24-720 hours, by default it is 72 (3 days)

Translate

Sign up

Login with SSO

Login to the community

Login with SSO