Description
This article describes and presents a solution for, a common scenario where users connected to FortiSASE try to access a destination host with an expired certificate, and the connection is blocked. The blocked destination host could be an internal or external host with an expired certificate.
When this situation occurs, by default, a block page similar to the one shown below will be displayed to the user:
Additionally, a log with the Event Type of 'ssl-anomaly', Event Subtype of 'certificate-anomaly', and Message of 'SSL connection is blocked, certificate-status:expired' is expected under Analytics -> Security -> SSL Inspection:
date=2024-07-24 time=17:17:38 id=7395252759596892192 itime="2024-07-24 17:17:40" euid=1243 epid=104 dsteuid=3 dstepid=101 logver=702086296 sfsid=7395252787519154087 type="utm" subtype="ssl" level="warning" sessionid=240354 policyid=81 srcip=100.65.32.1 dstip=104.154.89.105 srcport=59814 dstport=443 proto=6 logid=1700062303 service="SSL" user="user@example.com" action="blocked" eventtime=1721841457918915510 srcintfrole="undefined" dstintfrole="undefined" srcintf="ssl.root" dstintf="port4" eventtype="ssl-anomaly" profile="Owner" hostname="expired.badssl.com" certhash="forticlient" msg="SSL connection is blocked, certificate-status: expired." tz="+0000" srcdomain="3144968954924B1EA6FB4C79FB7BBABB" vrf=10 eventsubtype="certificate-anomaly" srcuuid="4a99962a-2a8b-51ef-bc30-e81ae7f275f8" dstuuid="e9aa3a7e-0162-51ee-d7e8-23f0957fb433" direction=outbound policytype="policy" srccountry="Reserved" dstcountry="United States" poluuid="4471cb3a-455e-51ef-127d-967ee915c0c1" devid="FGVMPGTMxxxxxxxx" vd="root" csf="0hqzec0p" dtime="2024-07-24 17:17:38" itime_t=1721841460 devname="San_Jose_California_USA"
Scope
FortiSASE.
Solution
- In the SSL Inspection logs, identify the Policy ID(s) affected. Note the column header for Policy ID is not enabled by default and has to be enabled by the FortiSASE administrator.
-
Navigate to Configuration -> Policies. Between Internet Access and Private Access policies, locate the matching policy based on the policy ID(s) as determined in Step 1. For each policy, note the profile group that is being used in these policies.
-
Navigate to Configuration -> Security. Between Internet Access and Private Access profile groups, locate the matching profile group(s) from Step 2. Under the 'Configure SSL' menu, change the 'Expired certificates' setting from Block to Allow. Note this change will apply to all policies that are utilizing these profile group(s). If the desired result is to only allow expired certificates for specific destination hosts, a new, specific policy and profile group should be created instead.
