Full-Inspection issues with Internet Explorer and Firefox

[prowl65]

Have an interesting problem running FortiOS 6.2.3 on our Fortigate.  We utilize full SSL inspection with a Subordinate CA Cert signed by our domain CA.  IE, Firefox and Chrome work with the cert (Domain CA cert is in their trusts) for most sites as expected.

We do have one site we use that only Chrome is able to access. 

IE returns a Can't connect, security to this page, TLs, etc.....

FIREFOX returns returns a PR_END_OF_FILE_ERROR.

Chrome works.

Without the inspection all 3 browsers work to the site.

Using gnutls-cli the following is returned without inspection.

---------------------------------------------------------------------------------------------------------------------------

Resolving 'dttrackerv4.ca:443'... Connecting to '67.223.104.81:443'... - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate[0] info:  - subject `CN=dttrackerv4.ca,OU=PositiveSSL,OU=Domain Control Validated', issuer `CN=Sectigo ECC Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB', serial 0x34553ee56384fedbcc1c5da92cab5975, EC/ECDSA key 256 bits, signed using ECDSA-SHA256, activated `2019-10-15 00:00:00 UTC', expires `2020-10-14 23:59:59 UTC', pin-sha256="gFaKRMv4lh6ZWVJf2HebLzHJwd6C4D3IpsAtY8nZQF0="         Public Key ID:                 sha1:14f3484943859d8174054c2f7361ee63daaa0e0d                 sha256:80568a44cbf8961e9959525fd8779b2f31c9c1de82e03dc8a6c02d63c9d9405d         Public Key PIN:                 pin-sha256:gFaKRMv4lh6ZWVJf2HebLzHJwd6C4D3IpsAtY8nZQF0= - Certificate[1] info:  - subject `CN=Sectigo ECC Domain Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB', issuer `CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US', serial 0x00f3644e6b6e0050237e0946bd7be1f51d, EC/ECDSA key 256 bits, signed using ECDSA-SHA384, activated `2018-11-02 00:00:00 UTC', expires `2030-12-31 23:59:59 UTC', pin-sha256="6YBE8kK4d5J1qu1wEjyoKqzEIvyRY5HyM/NB2wKdcZo=" - Certificate[2] info:  - subject `CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US', issuer `CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE', serial 0x76d8b786d1f3524fee953e71403d99d5, EC/ECDSA key 384 bits, signed using RSA-SHA384, activated `2000-05-30 10:48:38 UTC', expires `2020-05-30 10:48:38 UTC', pin-sha256="ICGRfpgmOUXIWcQ/HXPLQTkFPEFPoDyjvH7ohhQpjzs=" - Status: The certificate is trusted. |<1>| The hash size used in signature (20) is less than the expected (32) - Description: (TLS1.2-X.509)-(ECDHE-SECP256R1)-(ECDSA-SHA1)-(AES-128-GCM) - Session ID: AB:04:00:00:F0:CB:FF:0A:8E:F5:F9:F2:64:27:13:88:CF:C8:A4:85:DE:D8:F4:17:85:03:DB:1D:A8:CE:E0:B0 - Options: extended master secret, safe renegotiation, - Handshake was completed

---------------------------------------------------------------------------------------------------------------------------

Using Full inspection the following is returned:

---------------------------------------------------------------------------------------------------------------------------

Resolving 'dttrackerv4.ca:443'... Connecting to '67.223.104.81:443'... *** Fatal error: The TLS connection was non-properly terminated.

---------------------------------------------------------------------------------------------------------------------------

Wondering if anyone has any ideas. I do have a tac case open but, they are looking for me to create new certs so that the end client has the private keys of the cert on the Fortigate. 

Thanks

[leviu]

See this reddit post since the forum isn't that helpful. 

See also this Sectigo/COMOD article.

[emnoc]

The cert in his chain is expired , needs to be corrected and a new certificate issued,

Ken Felix

[Salas]

I opened support ticket.

The response is:

"You are hitting a known issue ID: 638593 - Proxy Inspection Causing Certificate Errors The engineering team is currently working on this issue. The only currently known workaround is to use a "flow-based" inspection on the policy."

[Admin_FTNT]

You may like to read this article: https://kb.fortinet.com/k...amp;externalId=FD49028

[nicolasross]

Salas wrote:

"You are hitting a known issue ID: 638593 - Proxy Inspection Causing Certificate Errors

The engineering team is currently working on this issue. The only currently known workaround is to use a "flow-based" inspection on the policy."

That is strange. I was also having this issue, but it was a majority of websites, even docs.fortinet.com where the intermediate certificate is valid. That bug isn't shown in the known issue with 6.2.5...

[Alexander_Mueller]

HI,

is there any Solution, have upadate to 6.2.5 because ofproblem with the VPN, and now we have the same problem, but only with Firefox and Chrome, in IE the websites are working.

If we open the website in IE, then its working in Chrome and Firefox, but only a period time, then problem is back

[nicolasross]

Alexander Mueller wrote:

is there any Solution, have upadate to 6.2.5 because ofproblem with the VPN, and now we have the same problem, but only with Firefox and Chrome, in IE the websites are working.

If we open the website in IE, then its working in Chrome and Firefox, but only a period time, then problem is back

You can put the policy in flow mode. As per the ticket I opened, it's bug id 0617934. Will be fixed in 6.2.6, no ETA.

[Alexander_Mueller]

Hi,

we are using Proxy Policy and there no flow mode, its only in ipv4 Policy available and there its active

[nicolasross]

Alexander Mueller wrote:

we are using Proxy Policy and there no flow mode, its only in ipv4 Policy available and there its active

See there :