Certificate issue

[CAD]

Hello,

i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found  error  below:

"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1".

what should to do to solve this issue ?

thanks

[emnoc]

What error are you getting specifically ? And yahoo.com does not use a  SHA1 certificate btw?

I bet you have a proxy inserted and your getting that error/warning due to the proxy certificate.

[CAD]

Hello, I've mentioned error above between quote, in fact, is not the fault meaning mistake only a red cross on the word (HTTPS :) in the address bar. Yes, we have an proxy, but we use it for other purposes.

thanks.

[emnoc]

Check the  website via a external site if suspect the site is not sha1

e.g

[link]https://shaaaaaaaaaaaaa.com/check/[/link]

http://sha1affected.com/

Than check your browser and/or  proxy for rejection or warning for sha1.

https://www.elie.net/blog/security/19.5-percent-of-https-sites-trigger-browser-warning-as-they-use-s...

I'm on  chrome 48 and it will warn with a "click" box,firefox  44.0.2 doesn't care.

Ken

[CAD]

sorry for delay reply ,i was in vacation.

when press the first link i got the below result:

"Cannot GET /check/"

it has been checked Some sites that I was faced problem of certification , via the link you provided me , and got the following result:

"Error checking support.fortinet.com: x509: certificate signed by unknown authority"

"Results for yahoo.com

The certificates for yahoo.com do not contain SHA1 signatures and won't be affected" please let me know if need further information. again sorry for delay replay. thanks 

[CAD]

any suggest to avoid this issue?

[emnoc]

It would help to determine the following;

1: screenshot of the browser  cert error

2: diag debug flow  with a filter that matches the src  or dst

3:  the firewall policy and any SSL inspection profile

If #3 is applicable, have to tried to place a specify fw-policy ahead of that in the sequence to see if the problem stays.? I can tell you the  yahoo.com SAN cert is NOT a sha1 certificate not expiring  or expired

[CAD]

Thanks for reply,

i have tried to run command diagnose debug flow but nething happen:

FG200D# diagnose debug info debug output: enable console timestamp: disable console no user log message: disable zebos debug level: 306783854 (0x144826d2) CLI debug level: 3 FG200D # diagnose debug flow filter daddr 10.245.76.x FG200D #

also i uploded the screenshot for certificate error please check attached file.

thanks 

[emnoc]

Okay my  hunch where right, you have the FGT as a proxy ( see the certificate has FGT ) This is not a trusted certificate hence the error. You would need to import the certificate into the  chrome browser and trust it.

Also you need to setup the diag debug flow properly for that to work and provide output

e.g

diag debug flow filter addr x.x.x.x

diag debug flow show console en

diag debug en

diag debug flow trace start 100 < this is what starts the trace and for x amount  adjust as required

after your finish you  diag debug reset  to clear and diag debug disable

about the certificate your choice depends on  OS but you can import the certificate and mark is as "trust always" or something like that. Than your browser will not warn you for just that certificate. Other options are to get away of proxy and/or buy a proper CA trust signed certificate that's sha2 if your worried about sha1.

btw: The website earlier  needs you to input value for https://shaaaaaaaaaaaaa.com/   you just don't place check on the line with no option.

e.g  checking for sha1 on  FTNT demo FGT140D @ www.fortigate.com

https://shaaaaaaaaaaaaa.c./check/www.fortigate.com

[CAD]

Thanks emnoc for help , the warning appear for all clients in my network , how to import for all.

What is the certificate name that should be imported.

please excuse me for this question because my knowledge very little.

thanks again for help.