Certificate issue

CAD · ‎02-25-2016

Hello,

i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found error below:

"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1".

what should to do to solve this issue ?

thanks

Ricardo_Tomas · ‎03-09-2016

Hello,

My guess is your unit is doing ssl offload to do one or more security features (IPS or Application control or HTTPS inspection or Antivirus or web filter or explicit proxy) , using an men in the middle approach. That’s fine, it is the common solution.

Some type of ssl old versions have been depreciated and chrome is giving warnings about that. With time, it will start to block it, forcing a manual override.

The problem is the certificate that forti unit is giving to the browser is using that old ssl version.

To resolve it, you need to put a new one with a newer ssl version in forti unit and in the pc’s.

The easier path is to upgrade the forti unit, since the newer versions have latest ssl version, and then reuse the GPO to put the newer certificate in all pc’s (no problem leaving the old one).

One last thing, both things have to be done at the same time, since you only have the certificate after the upgrade, and you will only have the clean https after the computers have the gpo with the certificate (before, you will have a nasty certificate not trustiest)

View solution in original post

emnoc · ‎02-25-2016

What error are you getting specifically ? And yahoo.com does not use a SHA1 certificate btw?

I bet you have a proxy inserted and your getting that error/warning due to the proxy certificate.

PCNSE

NSE

StrongSwan

CAD · ‎02-25-2016

Hello, I've mentioned error above between quote, in fact, is not the fault meaning mistake only a red cross on the word (HTTPS :) in the address bar. Yes, we have an proxy, but we use it for other purposes.

thanks.

emnoc · ‎02-25-2016

Check the website via a external site if suspect the site is not sha1

e.g

[link]https://shaaaaaaaaaaaaa.com/check/[/link]

http://sha1affected.com/

Than check your browser and/or proxy for rejection or warning for sha1.

https://www.elie.net/blog/security/19.5-percent-of-https-sites-trigger-browser-warning-as-they-use-s...

I'm on chrome 48 and it will warn with a "click" box,firefox 44.0.2 doesn't care.

Ken

PCNSE

NSE

StrongSwan

CAD · ‎02-28-2016

sorry for delay reply ,i was in vacation.

when press the first link i got the below result:

"Cannot GET /check/"

it has been checked Some sites that I was faced problem of certification , via the link you provided me , and got the following result:

"Error checking support.fortinet.com: x509: certificate signed by unknown authority"

"Results for yahoo.com

The certificates for yahoo.com do not contain SHA1 signatures and won't be affected"

please let me know if need further information.

again sorry for delay replay.

thanks

CAD · ‎03-01-2016

any suggest to avoid this issue?

emnoc · ‎03-01-2016

It would help to determine the following;

1: screenshot of the browser cert error

2: diag debug flow with a filter that matches the src or dst

3: the firewall policy and any SSL inspection profile

If #3 is applicable, have to tried to place a specify fw-policy ahead of that in the sequence to see if the problem stays.? I can tell you the yahoo.com SAN cert is NOT a sha1 certificate not expiring or expired

PCNSE

NSE

StrongSwan

CAD · ‎03-02-2016

Thanks for reply,

i have tried to run command diagnose debug flow but nething happen:

FG200D# diagnose debug info debug output: enable console timestamp: disable console no user log message: disable zebos debug level: 306783854 (0x144826d2) CLI debug level: 3 FG200D # diagnose debug flow filter daddr 10.245.76.x FG200D #

also i uploded the screenshot for certificate error please check attached file.

thanks

emnoc · ‎03-02-2016

Okay my hunch where right, you have the FGT as a proxy ( see the certificate has FGT ) This is not a trusted certificate hence the error. You would need to import the certificate into the chrome browser and trust it.

Also you need to setup the diag debug flow properly for that to work and provide output

e.g

diag debug flow filter addr x.x.x.x

diag debug flow show console en

diag debug en

diag debug flow trace start 100 < this is what starts the trace and for x amount adjust as required

after your finish you diag debug reset to clear and diag debug disable

about the certificate your choice depends on OS but you can import the certificate and mark is as "trust always" or something like that. Than your browser will not warn you for just that certificate. Other options are to get away of proxy and/or buy a proper CA trust signed certificate that's sha2 if your worried about sha1.

btw: The website earlier needs you to input value for https://shaaaaaaaaaaaaa.com/ you just don't place check on the line with no option.

e.g checking for sha1 on FTNT demo FGT140D @ www.fortigate.com

https://shaaaaaaaaaaaaa.c./check/www.fortigate.com

PCNSE

NSE

StrongSwan

CAD · ‎03-02-2016

Thanks emnoc for help , the warning appear for all clients in my network , how to import for all.

What is the certificate name that should be imported.

please excuse me for this question because my knowledge very little.

thanks again for help.