FortiWeb - SNI settings

[romank]

Hello,

Gotta question regarding ssl certificate and SNI configuration. Im gonna use SNI solution, do I need to setup "certificates" on main page when creating main policy? please see screenshot. From my point of view no, cuz all certs info will be pointed in SNI policy, but I wannabe sure. I did test scenario where I put  a cert there and SSL Labs showed me some errors, and sometimes I was getting "pr_end_of_file_error" - but im not sure if this was cuz of this. 

 

[AEK]

Hi Romank

Used it few years ago so if I'm not wrong the Certificate field should be the default one it the requested domain name is not in the SNI. I'll try to double check this info.

[shafiq23]

Hello romank,

You can leave it blank as Client Hello contains SNI that would match domain name in the SNI policy associated in server policy.

"pr_end_of_file_error" error seems surrounding on TLS problem. You can try to enable only TLS 1.2 and 1.3 and test again.

Thanks.

Regards,

Shafiq