Troubleshooting Tip: FortiGate-1500D SSL VPN certificate errors after upgrading to v7.2.2+

[cravikumar]

Description	This article describes why SSL VPN stops working after upgrading from v7.0.x to v7.2.x in the FortiGate-1500D model. The SSL VPN debugs show 'no shared cipher' and the browser displays 'SSL_ERROR_NO_CYPHER_OVERLAP':
Scope	FortiGate-1500D
Solution	From the config file, under SSL VPN settings, the server cert is 'Fortinet_Factory'. GortiGate-1500D is a CP8 platform and the 'Fortinet_Factory' is 1024-bit. FortiOS was upgraded to OPENSSL 3.0.2 since v7.2.1 0752141, the 'Fortinet_Factory' does not fit OPENSSL 3.0 requirement, which causes the SSL handshake to fail. Debugs: FortiGate-1500D # 2022-12-02 13:22:58 [357:root:2]allocSSLConn:306 sconn 0x7f8ba56b1800 (0:root) 2022-12-02 13:22:58 [357:root:2]SSL state:before SSL initialization (10.10.170.16) 2022-12-02 13:22:58 [357:root:2]SSL state:fatal decode error (10.10.170.16) 2022-12-02 13:22:58 [357:root:2]SSL state:error:(null)(10.10.170.16) 2022-12-02 13:22:58 [357:root:2]SSL_accept failed, 1:unexpected eof while reading 2022-12-02 13:22:58 [357:root:2]Destroy sconn 0x7f8ba56b1800, connSize=0. (root) 2022-12-02 13:22:59 [358:root:2]allocSSLConn:306 sconn 0x7f8ba56b1800 (0:root) 2022-12-02 13:22:59 [358:root:2]SSL state:before SSL initialization (10.10.170.16) 2022-12-02 13:22:59 [358:root:2]SSL state:before SSL initialization (10.10.170.16) 2022-12-02 13:22:59 [358:root:2]no SNI received 2022-12-02 13:22:59 [358:root:2]client cert requirement: no 2022-12-02 13:22:59 [358:root:2]SSL state:fatal handshake failure (10.10.170.16) 2022-12-02 13:22:59 [358:root:2]SSL state:error:(null)(10.10.170.16) 2022-12-02 13:22:59 [358:root:2]SSL_accept failed, 1:no shared cipher 2022-12-02 13:22:59 [358:root:2]Destroy sconn 0x7f8ba56b1800, connSize=0. (root) 2022-12-02 13:22:59 [359:root:2]allocSSLConn:306 sconn 0x7f8ba56b1800 (0:root) 2022-12-02 13:22:59 [359:root:2]SSL state:before SSL initialization (10.10.170.16) 2022-12-02 13:22:59 [359:root:2]SSL state:before SSL initialization (10.10.170.16) 2022-12-02 13:22:59 [359:root:2]no SNI received 2022-12-02 13:22:59 [359:root:2]client cert requirement: no 2022-12-02 13:22:59 [359:root:2]SSL state:fatal handshake failure (10.10.170.16) 2022-12-02 13:22:59 [359:root:2]SSL state:error:(null)(10.10.170.16) 2022-12-02 13:22:59 [359:root:2]SSL_accept failed, 1:no shared cipher Creating an SSL VPN cert on FortiGate will resolve the issue: config vpn ssl settings     set ssl-max-proto-ver tls1-2     set ssl-min-proto-ver tls1-0 set servercert "Fortinet_Factory"<-----     set algorithm low     set idle-timeout 14400 end To create a certificate, Go to VPN -> SSL VPN Settings -> Server Certificate -> Create Certificate -> Generate Certificate. Once generated, replace the old SSL VPN certificate with the new one.