Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

Fortigate using proxy to update fortigurad issue



I using proxy to update fortiguard server, but it seens like fail.

following is my setting and diagnostics.


config system autoupdate tunneling

    set address    
    set port 80
    set status enable    



config system fortiguard

   set fortiguard-anycast disable

   set port 8888

   set protocol udp



execute update-now
upd_daemon[1800]-Found cached action=00000001
do_setup[347]-Starting SETUP
upd_fds_load_default_server[920]-Addr=[], weight=1787681287
upd_fds_load_default_server[920]-Addr=[], weight=1247489738
upd_fds_load_default_server[920]-Addr=[], weight=693776585
upd_fds_load_default_server[939]-Resolve and add fds ip address OK.
upd_fds_load_default_server6[1046]-Resolve and add fds ipv6 address failed.
upd_comm_connect_fds[459]-Trying FDS
tcp_connect_fds[168]-Proxy tunneling enabled to
negotiate_proxy_tunnel[138]-tunneling request=[CONNECT HTTP/1.0
User-agent: Fortinet/7.02

] response=[HTTP/1.0 200 Connection established
Date: Thu, 20 Jun 2024 04:32:47 GMT
Connection: close
Via: 1.1 PHQPXY

[115] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default)
[115] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory_Backup.cer, root ca Fortinet_CA_Backup, idx 1
[484] ssl_ctx_use_builtin_store: Loaded Fortinet Trusted Certs
[504] ssl_ctx_use_builtin_store: Enable CRL checking.
[511] ssl_ctx_use_builtin_store: Enable OCSP Stapling.
[814] ssl_ctx_create_new: SSL CTX is created
[841] ssl_new: SSL object is created
[194] ssl_add_ftgd_hostname_check: Add hostname checking ''
[908] ssl_set_hostname: Set hostname ''
[707] __ssl_info_callback: before SSL initialization
[707] __ssl_info_callback: SSLv3/TLS write client hello
[707] __ssl_info_callback: SSLv3/TLS write client hello
[707] __ssl_info_callback: SSLv3/TLS read server hello
[361] __ssl_crl_verify_cb: Cert error 19, self-signed certificate in certificate chain. Depth 1
__upd_peer_vfy[329]-Server certificate failed verification. Error: 19 (self-signed certificate in certificate chain), depth: 1, subject: /DC= xxx/DC=xxx/C                                                                                                                                                                N=xxxxxxx.
[1049] ssl_connect: SSL_connect failes: error:0A000086:SSL routines::certificate verify failed
ssl_connect_fds[393]-Failed SSL connecting (5,0,Success)
[206] __ssl_data_ctx_free: Done
[1094] ssl_free: Done
[198] __ssl_cert_ctx_free: Done
[1104] ssl_ctx_free: Done





Hi Kyle

I'm not sure UDP can be proxied.

Can you try this?

config system fortiguard
unset port
unset protocol
set proxy-server-ip 172.16.x.x
set proxy-server-port 80

> Error: 19 (self-signed certificate in certificate chain), depth: 1, subject: /DC= xxx/DC=xxx/CN=xxxxxxx.


This is presumably your internal CA issued for corporate TLS inspection (based on the DC=X,DC=Y subject structure), performing TLS decryption/inspection of the FortiGuard-bound traffic.


You will need to exempt this traffic from being inspected. The FortiGate has a fixed set of acceptable CAs for this communication, and any deep TLS inspection will break the comms. (note that importing the CA into the FortiGate will not help)

[ corrections always welcome ]
New Contributor II

Hi @pminarik 


So, if I try to FortiGuard server not inspect, then what the IP&FQDN range of FortiGuard server are?




In this specific case, the service getting broken is attempting access to "". Resolve that to an IP on your proxy and ensure it is exempt.


> [194] ssl_add_ftgd_hostname_check: Add hostname checking ''


The full list of various anycast/unicast server endpoints is listed here:

[ corrections always welcome ]

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors