Hello,
i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found error below:
"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1".
what should to do to solve this issue ?
thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello,
My guess is your unit is doing ssl offload to do one or more security features (IPS or Application control or HTTPS inspection or Antivirus or web filter or explicit proxy) , using an men in the middle approach. That’s fine, it is the common solution.
Some type of ssl old versions have been depreciated and chrome is giving warnings about that. With time, it will start to block it, forcing a manual override.
The problem is the certificate that forti unit is giving to the browser is using that old ssl version.
To resolve it, you need to put a new one with a newer ssl version in forti unit and in the pc’s.
The easier path is to upgrade the forti unit, since the newer versions have latest ssl version, and then reuse the GPO to put the newer certificate in all pc’s (no problem leaving the old one).
One last thing, both things have to be done at the same time, since you only have the certificate after the upgrade, and you will only have the clean https after the computers have the gpo with the certificate (before, you will have a nasty certificate not trustiest)
What error are you getting specifically ? And yahoo.com does not use a SHA1 certificate btw?
I bet you have a proxy inserted and your getting that error/warning due to the proxy certificate.
PCNSE
NSE
StrongSwan
Hello, I've mentioned error above between quote, in fact, is not the fault meaning mistake only a red cross on the word (HTTPS :) in the address bar. Yes, we have an proxy, but we use it for other purposes.
thanks.
Check the website via a external site if suspect the site is not sha1
e.g
[link]https://shaaaaaaaaaaaaa.com/check/[/link]
Than check your browser and/or proxy for rejection or warning for sha1.
I'm on chrome 48 and it will warn with a "click" box,firefox 44.0.2 doesn't care.
Ken
PCNSE
NSE
StrongSwan
sorry for delay reply ,i was in vacation.
when press the first link i got the below result:
"Cannot GET /check/"
it has been checked Some sites that I was faced problem of certification , via the link you provided me , and got the following result:
"Error checking support.fortinet.com: x509: certificate signed by unknown authority"
any suggest to avoid this issue?
It would help to determine the following;
1: screenshot of the browser cert error
2: diag debug flow with a filter that matches the src or dst
3: the firewall policy and any SSL inspection profile
If #3 is applicable, have to tried to place a specify fw-policy ahead of that in the sequence to see if the problem stays.? I can tell you the yahoo.com SAN cert is NOT a sha1 certificate not expiring or expired
PCNSE
NSE
StrongSwan
Thanks for reply,
i have tried to run command diagnose debug flow but nething happen:
FG200D# diagnose debug info debug output: enable console timestamp: disable console no user log message: disable zebos debug level: 306783854 (0x144826d2) CLI debug level: 3 FG200D # diagnose debug flow filter daddr 10.245.76.x FG200D #
also i uploded the screenshot for certificate error please check attached file.
thanks
Okay my hunch where right, you have the FGT as a proxy ( see the certificate has FGT ) This is not a trusted certificate hence the error. You would need to import the certificate into the chrome browser and trust it.
Also you need to setup the diag debug flow properly for that to work and provide output
e.g
diag debug flow filter addr x.x.x.x
diag debug flow show console en
diag debug en
diag debug flow trace start 100 < this is what starts the trace and for x amount adjust as required
after your finish you diag debug reset to clear and diag debug disable
about the certificate your choice depends on OS but you can import the certificate and mark is as "trust always" or something like that. Than your browser will not warn you for just that certificate. Other options are to get away of proxy and/or buy a proper CA trust signed certificate that's sha2 if your worried about sha1.
btw: The website earlier needs you to input value for https://shaaaaaaaaaaaaa.com/ you just don't place check on the line with no option.
e.g checking for sha1 on FTNT demo FGT140D @ www.fortigate.com
https://shaaaaaaaaaaaaa.c./check/www.fortigate.com
PCNSE
NSE
StrongSwan
Thanks emnoc for help , the warning appear for all clients in my network , how to import for all.
What is the certificate name that should be imported.
please excuse me for this question because my knowledge very little.
thanks again for help.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1645 | |
1070 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.