Technical Tip: Modify the TLS version for the FortiGate GUI access

Description

This article describes how to change the TLS version via CLI when accessing the GUI.

Scope

FortiGate.

Solution

In current FortiOS versions, the default HTTPS administrative access TLS versions are TLS 1.2 and TLS 1.3.

To verify the TLS versions enabled for HTTPS administrative access:

config system global
show full-configuration | grep 'min-proto'
end 

The output screenshot below is an example from the firmware version 7.2.8: 

If VDOMs are enabled, enter this again:

config system global 
get | grep 'min-proto'
ssl-min-proto-version: TLSv1-2

To change this setting from the CLI:

config system global
    set admin-https-ssl-versions (shift + ?) <- To list the available TLS version.

tlsv1-0 TLS 1.0.
tlsv1-1 TLS 1.1.
tlsv1-2 TLS 1.2.
set admin-https-ssl-versions tlsv1-2 <- With this setting, only TLS 1.2 is allowed.

end

Starting from FortiOS 6.4, TLS 1.0 is no longer available for HTTPS administrative access, while TLS 1.3 is supported.

config system global

set admin-https-ssl-versions 
tlsv1-1 TLS 1.1.
tlsv1-2 TLS 1.2.
tlsv1-3 TLS 1.3.

TLS 1.3  is not available in Low-Encryption(LENC) FortiGates. 

Related documents:

System administrator best practices - FortiGate documentation

TLS configuration - FortiGate v7.2.9 administration guide

TLS configuration - FortiGate v7.4.5 administration guide

Technical Tip Low Encryption LENC device FAQ 

Technical Tip: How to prove TLS 1.1 is disabled in FortiGate access