Certificate errors after applying 6.4.9

[ikmarwright]

The error is intermittent since applying 6.4.9 to 6.4.8. The errors appear in FortiClient VPN versions 7.0.1.0083 and 7.0.5.0238. Reinstalling the client software makes no difference. Reinstalling the certificate makes no difference. It is rare, but it is happening to many users.

Just starting to track it down, but wondering if anyone else has noticed this.

[xsilver_FTNT]

Hi,

how about to start also with WHAT error do you see?
What is intermittent by your means .. once a year, month, hour ?
Some details on cert like used ciphers and also if signing CA cert was imported to FortiGate.

[ikmarwright]

I wasn't asking for help to narrow it down. I was asking if anyone has seen certificate errors when connecting using SSL VPN after moving to 6.4.9. Obviously you haven't.

We only switched to 6.4.9 ten days ago and I've seen three or four errors but the most common is a -11 (The server you want to connect to requests identification, please choose a certificate and try again)

Except there is a validate certificate chosen. And since it actually works the second or third time it's tried, the firewall thinks it's valid too.

It's just an OpenSSL certificate that I've used since Nov 2020 without a problem and doesn't expire for another 3 years. 

My focus is elsewhere at the moment, so I was hoping to find out if this a problem for us only or more general. 

[infotechglt]

Having the same issue. We don't even use certificate authentication, but it's asking for a certificate now. Only certain users are experiencing this problem. I am not one of them.

[jim3cantos]

Same problem here after upgrading from 6.0.14 -> 6.2.10 -> 6.4.8 -> 6.4.9 a few days ago. In our case the error is with Forticlient 6.0.9 and we are using the default Fortinet certificate. It ends up connecting the second or third time it's tried. Only reported by 2 or 3 users but probably happening to more but they don´t complain if they are able to connect after retry...

[jim3cantos]

In our case, in the few cases that users still got the error, we implemented this suggestion: "On the Client in IE / Options / Advanced, Turn on TLS 1.2 and TLS 1.3 (and turn off TLS 1.0 and TLS 1.1)" seen in the comments of this page. Not sure if placebo effect or else, but no more complaints from the same users.

[jim3cantos]

May be it isn't placebo effect, because it seems that we have solved another synchronization problem with one Outlook mail client (that appeared also after the FortiOS migration) with the same "prescription"...

[jim3cantos]

Update: The problem keeps occurring from time to time, even with the workaround indicated above. Now we have applied also another change in the Fortigate configuration as indicated by Support: set ssl-min-proto-ver tls1-0

For now it seems to be working with the users tested, even tough it doesn't seem to be a good solution in terms of security. From 6.0.9 release notes:

Minimum version of TLS services automatically changed

For improved security, FortiOS 6.4.9 uses the ssl-min-proto-version option (under config system global) to control the minimum SSL protocol version used in communication between FortiGate and third-party SSL and TLS services.

When you upgrade to FortiOS 6.4.9 and later, the default ssl-min-proto-version option is TLS v1.2. The following SSL and TLS services inherit global settings to use TLS v1.2 as the default. You can override these settings.

[ikmarwright]

I hope you find a workaround, but all our computers had TLS 1.0 and 1.1 turned off a long time ago because a specific remote site demanded it. Only 1.2 and 1.3 are active.

[ikmarwright]

Never did figure it out, but after upgrading to 7.0.6 two weeks ago I haven't seen the error.