Intermediate certificate

[serveradmin]

Hi,

I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".

I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

[serveradmin]

7.2.5 works aswell. Definitely bug in FortiOS. Thanks everyone for your effort!

[serveradmin]

As I posted earlier I have already done that. Intermediate certificate is uploaded to Fortigate. Root is also present and .pfx is uploaded as bundle of certificate, intermediate etc.

[nobox]

I have the same problem on 7.4 but I discovered that after changing the policy to Flow-based, the certificate is sent in its entirety along with the intermediate one, this is not a solution, but rather a workaround, but always something

[daniels7]

We experience the same issue on 7.4 as well. The workaround with using Flow-based instead of Proxy-based works but the Bug should be fixed soon

[JasoSmit1]

I'm running FortiOS 7.2.6 and had this same issue with the sslvpn site and a GoDaddy (Starfield) intermediate CA certificate.  I inadvertently resolved it while adjusting ciphers to improve SSL Report score from the great Qualys SSL Labs.  I'm not sure why the settings below worked or if applicable to a virtual server but the Fortigate now sends the full certificate chain (and increased my report score from B to A+).

config vpn ssl settings
    set banned-cipher RSA DHE DSS CAMELLIA 3DES SHA1 STATIC ARIA AESCCM
    set ciphersuite TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-CCM-SHA256

    set dtls-min-proto-ver dtls1-2

end

Update:

After removing the config I added above the issue remains fixed.  It is possible that just adding the intermediate CA is insufficient to fix the issue which also requires the webserver to restart in order see the added certificate.  This is based on the assumption that modifying the vpn ssl settings caused the webserver to restart and see the ICA was present.