Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
adder666
New Contributor

Some .gov sites blocked, others are not?

I'm a novice with this, but I have web filters enabled and still having trouble reaching a few government sites, for example www.pittsburghca.gov. But others, like [link]https://www.dmv.ca.gov[/link] work fine. I've explicitly allowed the blocked sites and still same error:

 

This Connection is Invalid. SSL certificate expired.

A secure connection to www.pittsburgca.gov cannot be established.

When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

Sitewww.pittsburgca.govCertificate CNsan-g2.granicusgovaccess.netCertificate AuthorityR3Certificate Validity Not Before: Sep 20 16:46:45 2021 GMT Not After: Dec 19 16:46:44 2021 GMT

 

What am I missing? And remember, I'm a real novice with the Fortinet equipment (new job, this is what they had in place) so explain to me like I'm a 5 year old. It's a Fortigate 100E with firmware v7.0.1 build0157 (GA). Thanks!

33 REPLIES 33
boneyard
Valued Contributor

it is also posted in the other thread here but to have it complete, after that trick with the DNS blackhole you need to clear the certificate cache most likely.

 

flow-mode: # diagnose ips share clear cert_verify_cache proxy-mode (process restart will have impact): # diagnose test application wad 99

 

a true fix will be an actual code change indeed, but with this you can move on without having to lower security.

frank0957
New Contributor

I'm facing the same problem on OS FortiOS v7.0.1 build0157 (GA)

 

When I try to change the Flow mode and create a new policy to allow invalid SSL certificates, it still doesn’t work.

 

tuanccs

Still same problem after tried workaround 1 on fortigate 6.2.9.

Does anyone else get it working on fortigate 6.2?

boneyard
Valued Contributor

what is exactly workaround 1? i dont hear any issues at customers at the moment.

tuanccs

https://www.fortinet.com/blog/psirt-blogs/fortinet-and-expiring-lets-encrypt-certificates

Workaround 1 – Prevent fallback to the expired Root CA

config system dns-database     edit "1"         set domain "identrust.com"         config dns-entry             edit 1                 set hostname "apps"                 set ip 127.0.0.1             next         end     next end

 

Doesn't work with deep inspection policy.

boneyard
Valued Contributor

do you have that latest certificate bundle? did you clear the certificate cache afterwards?

tuanccs

Yes, did all of that.

FTG # diagnose autoupdate versions | grep "Certificate Bundle" -A 5 Certificate Bundle --------- Version: 1.00028 Contract Expiry Date: n/a Last Updated using scheduled update on Fri Oct 1 10:20:54 2021 Last Update Attempt: Thu Oct 7 10:21:38 2021

FTG # diag ips share clear cert_verify_cache

Jirka1
Contributor III

tuanccs wrote:

 

Doesn't work with deep inspection policy.

 

It's not true. We use deep inspection (proxy mode) everywhere and this workaround works. Jirka

tuanccs
New Contributor

sigmasoftcz wrote:

 

It's not true. We use deep inspection (proxy mode) everywhere and this workaround works. Jirka

are you on 6.2?

We use flow mode

 

Tuan

frank0957

I will try workaround 2 tonight, will feedback there, after outcome.

we're on 7.0.1, use proxy mode