Chrome - ERR_EMPTY_RESPONSE

[gsarica]

Just wondering if anyone has seen this error message in Chrome before, ERR_EMPTY_RESPONSE. We've been testing deep packet inspection and I thought it may be due to that, but a user who isn't in the test group reported he's seeing the same issue in Chrome also. Basically a page will load with this error and a refresh will allow access to the site. This happens pretty randomly, on different sites with no rhyme or reason. We just updated to 5.4.2, though I was seeing this on 5.4.1. Is there anything I can check? 

Thanks!

[Alby23]

Just to make a test, try to create a SSL/SSH Inspection Profile with "Inspect All Ports" in the Deep Inspection Section.

[al]

I also have the same issue on 5.4.1, except a little worse; any site, not on the SSL inspection bypass list, will give this error and there is no workaround except for turning SSL inspection off for that policy. I have created a ticket with Fortinet and will update as we work through it.

[gsarica]

Also have an update. We have a test policy in place with only a few users in it for deep inspection testing as I said above. I turned off that policy so that everyone is going through the standard certificate inspection now and no one has complained about this error since.

I've never seen an instance when one policy would bleed into another but it seems that was the case here somehow. With the policy turned on, even people not in the test group saw the Chrome error, with the policy off everyone seems to be ok.

[al]

Fortinet is still researching, but in the meantime it appears this issue is limited to sites that have "mediocre" SSL certificates. Sha1 signed certs cause the problem in Chrome, but work Okay in IE11. TLS 1.0/1.1 (not TLS 1.2 capable) and/or the RC4 cipher being available also seems to cause the problem in both browsers. 

I've been able to re-create the issue on godaddy.com, id.wsj.com (the login portal to WSJ) and stepstoneglobal.com with varying levels of issues: all three don't work at all in Chrome, godaddy gives a white screen in IE11 but a "connection refused" in Edge, and stepstoneglobal.com works in IE11/Edge.