FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes how to resolve the SSL VPN connection when using X509 certificates signed using SHA1.
Scope
FortiGate, FortiClient.
Solution
In v7.4.x, FortiOS is using OpenSSL v3.0, which X509 certificates signed using SHA1 are no longer allowed at security level 1 (default level) and above.
To have a successful SSL VPN connection via FortiClient, set the minimum TLS version to tls1-1 which will lower the security level to 0:
config vpn ssl settings set ssl-min-proto-ver tls1-1 <----- end
Using SHA 1 certificates is strongly discouraged due to known vulnerabilities. It is recommended to generate and deploy certificates signed with SHA-256 or higher.
