ERR_SSL_PROTOCOL_ERROR on Google Chrome

[sforbus]

We are having a bizarre problem since updating to 6.2.1 (we updated due to a memory leak issue in 6.2.0).

Certain sites are giving us a ERR_SSL_PROTOCOL_ERROR only in Google Chrome. I have tried all the usual troubleshooting for this error, but the only thing that fixes it is restarting the fortigate. Two sites (facebook.com and login.renweb.com) both use TLS 1.3, but we can get to facebook without a problem and we cannot get to the other site. After rebooting the device, it works for several days and then starts behaving poorly again.

Other browsers work fine, including Internet Explorer, Edge (not Chromium based) and Firefox.

I have attempted to disable SSL certificate inspection, but that does not seem to affect the problem one way or another. I also tried putting the fortigate back on its factory certificate.

My next step will be to revert to 6.0 branch, where I did not experience this issue, but I figured I would post first to see if anyone had similar experiences.

[emnoc · Accepted solution]

Have anybody used curl against theses sites? Inspect the certificate and if you see any stale cert clear them. You can also test in a incognito window and see if the problem exists.

It sounds  like a browser issues. FWIW. I check all of those sites from  fortios v6.2.3 and see no issues using chrome on windows { Version 78.0.3904.87 (Official Build) (64-bit) }

Ken Felix

[kblackmore]

Try changing the SSL-VPN default port to something other than 443. By default it seems the SSL-VPN process interrupts the HTTPS GUI -  I think this is likely only relevant until VDOM's are enabled when the root VDOM will likely mean interfaces are assigned and SSL-VPN will be assigned to non root VDOM interfaces.

[dannyfontaine]

Hello,

A few days ago, I got the same error in my browser.

There are various reasons due to which your Chrome browser couldn’t establish a secure connection with the server

To fix ERR_SSL_PROTOCOL_ERROR I found a helpful blog on google. Read this https://www.cheapsslshop.com/blog/fix-err-ssl-protocol-error/ guide. I am sure it will really helpful to you

[dsobrinho]

Same problem Vmware version 6.4.6 after deploy vmware and start a basic configuration I have tried to access GUI via Chrome,Firefox,Edge etc and we have SSL problem report in this forum.

[dannyfontaine]

Hello dsobrinho,

I hope you are fine.

I have seen in your post that you have faced this error SSL_ERROR_RX_RECORD_TOO_LONG FIREFOX ERROR in your browser.

Kindly check this article:

https://www.cheapsslshop.com/blog/how-to-fix-the-ssl_error_rx_record_too_long-firefox-error/

I hope this article will help you to solve your problem

Waiting for your positive response.

[nsumner36]

Have you tried going to 6.4.7? If this only effects Chrome my guess is it is related to QUIC, have you tried blocking QUIC?

[irvinborder]

When a browser shows the Err_ssl_protocol_error, it indicates the browser is no longer able to access or initiate the secured communication. There is no definite guide for managing this error. Follow given steps to resolve this error from Client side:

• Try correcting the system date and time.
• Try clearing Google Chrome browsing data.
• Try clearing your SSL State.
• Try disabling the QUIC Protocol.
• Try checking your antivirus settings.
• Try enabling all SSL/TLS versions.

Also, this error is because of the following aerver side problems:

• Invalid SSL or SSL is untrusted (self-signed)
• SSL Not installed properly
• Old Technology or SSL/TLS version for encryption

[comparecheapssl]

This is the most common issue now and you can solve this issue with very basic steps. I found this blog with step by step solution to avoid this ssl error. 

[nitubisht]

The "ERR_SSL_PROTOCOL_ERROR" in Google Chrome typically indicates a problem with the SSL/TLS handshake process between the browser and the server. This error could also be caused by other factors. If you'd like, you can fix this guide https://www.ssl2buy.com/wiki/how-to-fix-err-ssl-protocol-error  which lists every reason why this issue could occur