Troubleshooting Tip: SSL VPN Debugs Error = SSL_accept failed, 1:unsupported protocol

[lgupta]

Description

This article describes the SSL VPN debugs Error = SSL_accept failed, 1:unsupported protocol.

Scope

All FortiOS.

Solution

SSL VPN configuration (using default):

FortiGate-KVM # config vpn ssl settings

FortiGate-KVM (settings) # show full-configuration

config vpn ssl settings

    set status enable

    set reqclientcert disable

    set ssl-max-proto-ver tls1-3    <- Maximum TLS Version Supported.

    set ssl-min-proto-ver tls1-2        <- Minimum TLS Version Supported.

Run the debugs:

# diag debug application sslvpn -1

# diag debug enable

Debugs output

[547:root:d8]allocSSLConn:306 sconn 0x7fc89ded3f00 (0:root)

[547:root:d8]SSL state:before SSL initialization (24.114.84.137)

[547:root:d8]SSL state:before SSL initialization (24.114.84.137)

[547:root:d8]SSL state:fatal protocol version (24.114.84.137)

[547:root:d8]SSL state:error:(null)(24.114.84.137)

[547:root:d8]SSL_accept failed, 1:unsupported protocol <-

[547:root:d8]Destroy sconn 0x7fc89ded3f00, connSize=0. (root)

Reason for this error:

The client and server do not support common SSL/TLS protocol versions or cipher suites.

Solution:

Option 1:

Reduce/Match the protocols on the host device (Windows example here).

Step 1: Control Panel -> Internet Options -> Advanced Tab -> Settings List.

Step 2: Scroll down to Security and look for SSL Versions.

Step 3: As shown in the above picture, the client is using TLS 1.1, but FortiGate supports minimum TLS 1.2.

Step 4: Select Use TLS 1.2 on the Client side to match the configuration on the FortiGate side.

Step 4: Apply and Save. Now it will be possible to connect successfully.

Option 2:

Change the Minimum and Maximum Protocol supported on the FortiGate.

FGT_A # config vpn ssl settings

FGT_A (settings) # set ssl-min-proto-ver ?

tls1-0    TLS version 1.0.

tls1-1    TLS version 1.1.

tls1-2    TLS version 1.2.

tls1-3    TLS version 1.3.

FGT_A (settings) # set ssl-max-proto-ver ?

tls1-0    TLS version 1.0.

tls1-1    TLS version 1.1.

tls1-2    TLS version 1.2.

tls1-3    TLS version 1.3.

After making the required changes, the user should be able to connect.

Note: it is possible to use any option 1 or 2; the protocol version must match on FortiGate and the Client Machine.