Full-Inspection issues with Internet Explorer and Firefox

[prowl65]

Have an interesting problem running FortiOS 6.2.3 on our Fortigate.  We utilize full SSL inspection with a Subordinate CA Cert signed by our domain CA.  IE, Firefox and Chrome work with the cert (Domain CA cert is in their trusts) for most sites as expected.

We do have one site we use that only Chrome is able to access. 

IE returns a Can't connect, security to this page, TLs, etc.....

FIREFOX returns returns a PR_END_OF_FILE_ERROR.

Chrome works.

Without the inspection all 3 browsers work to the site.

Using gnutls-cli the following is returned without inspection.

---------------------------------------------------------------------------------------------------------------------------

Resolving 'dttrackerv4.ca:443'... Connecting to '67.223.104.81:443'... - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info:  - subject `CN=dttrackerv4.ca,OU=PositiveSSL,OU=Domain Control Validated', issuer `CN=Sectigo ECC Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB', serial 0x34553ee56384fedbcc1c5da92cab5975, EC/ECDSA key 256 bits, signed using ECDSA-SHA256, activated `2019-10-15 00:00:00 UTC', expires `2020-10-14 23:59:59 UTC', pin-sha256="gFaKRMv4lh6ZWVJf2HebLzHJwd6C4D3IpsAtY8nZQF0="         Public Key ID:                 sha1:14f3484943859d8174054c2f7361ee63daaa0e0d                 sha256:80568a44cbf8961e9959525fd8779b2f31c9c1de82e03dc8a6c02d63c9d9405d         Public Key PIN:                 pin-sha256:gFaKRMv4lh6ZWVJf2HebLzHJwd6C4D3IpsAtY8nZQF0= - Certificate[1] info:  - subject `CN=Sectigo ECC Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB', issuer `CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US', serial 0x00f3644e6b6e0050237e0946bd7be1f51d, EC/ECDSA key 256 bits, signed using ECDSA-SHA384, activated `2018-11-02 00:00:00 UTC', expires `2030-12-31 23:59:59 UTC', pin-sha256="6YBE8kK4d5J1qu1wEjyoKqzEIvyRY5HyM/NB2wKdcZo=" - Certificate[2] info:  - subject `CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US', issuer `CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE', serial 0x76d8b786d1f3524fee953e71403d99d5, EC/ECDSA key 384 bits, signed using RSA-SHA384, activated `2000-05-30 10:48:38 UTC', expires `2020-05-30 10:48:38 UTC', pin-sha256="ICGRfpgmOUXIWcQ/HXPLQTkFPEFPoDyjvH7ohhQpjzs=" - Status: The certificate is trusted. |<1>| The hash size used in signature (20) is less than the expected (32) - Description: (TLS1.2-X.509)-(ECDHE-SECP256R1)-(ECDSA-SHA1)-(AES-128-GCM) - Session ID: AB:04:00:00:F0:CB:FF:0A:8E:F5:F9:F2:64:27:13:88:CF:C8:A4:85:DE:D8:F4:17:85:03:DB:1D:A8:CE:E0:B0 - Options: extended master secret, safe renegotiation, - Handshake was completed

---------------------------------------------------------------------------------------------------------------------------

Using Full inspection the following is returned:

---------------------------------------------------------------------------------------------------------------------------

Resolving 'dttrackerv4.ca:443'... Connecting to '67.223.104.81:443'... *** Fatal error: The TLS connection was non-properly terminated.

---------------------------------------------------------------------------------------------------------------------------

Wondering if anyone has any ideas. I do have a tac case open but, they are looking for me to create new certs so that the end client has the private keys of the cert on the Fortigate. 

Thanks

[Alexander_Mueller]

In the Proxy Policy is no flow option

[nicolasross]

Alexander Mueller wrote:

In the Proxy Policy is no flow option

Hmmm. And you are with 6.2.5 ? I suggest you open a ticket with support.

[lakshman]

Kindly check the below  Ref

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/722891/url-certificate-blacklist 

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/505842/certificate-inspection