ERR_SSL_PROTOCOL_ERROR on the newest Chrome 131

[Tutek]

Hi,

we have such problem on every webpages with the newest chrome version 131 error appears:

ERR_SSL_PROTOCOL_ERROR 

as I read Chrome implemented any new TLS mechanism in this version:

https://chromestatus.com/feature/5257822742249472

is any solution for this?

[sw2090]

ok the official workaround (that's what they said) that TAC just gave me in a call is to change Policies to proxy mode inspection. They're working on it internally and it will "hopefully be fixed with the next FOS Update"...

[pminarik]

If it helps you feel a bit better, given that this is a flow-mode specific issue, the fix will most likely be "just" an IPS engine update. A complete firmware update probably won't be necessary.

[FortiGab]

so the problem cannot be fixed by new ips engine update? @pminarik 

something different from what happened with kyber? https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Web-pages-not-loading-or-taking-too-...

which component is suffering ML-KEM ?

[pminarik]

Functionally the same situation as with Kyber. Just a new key exchange type that needs to be handled correctly by IPS engine. Note that if you set the Chrome flag "use-ml-kem" to disabled, it should revert to using Kyber and keep working (a temp solution, of course).

Fix will come in an updated IPS engine. There is no public fixed version of it yet (no firmware-default engines nor engines pushed via FortiGuard have a full fix yet)

The default 7.0.16 IPS engine has a partial fix, same for the engine pushed from FortiGuard for 7.2 (349 currently).

The fixes should be ready very soon. For most FortiOS branches, you will likely need to open a support ticket with TAC to request them initially. Automated distribution via FortiGuard will presumably happen eventually, but with some delay. (global deployment of a new engine version needs to be done with caution)

[sw2090]

they also have released a technical support doc on this: ERR_SSL_PROTOCOL_ERROR when using Flow-ba... - Fortinet Community

[sw2090]

oh and NO, Fortinet, switching from DPI to certificate inspection is NOT a solution