Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
serveradmin
New Contributor III

Intermediate certificate

Hi,

I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".

 

I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

1 Solution
serveradmin
New Contributor III

Hi,

 

FYI, I downgraded fortios to 6.4.14 and it works! So it seems like it is bug in FortiOS 7.4.0. I will check if the same problem is also on fortios 7.2.5

View solution in original post

24 REPLIES 24
serveradmin

7.2.5 works aswell. Definitely bug in FortiOS. Thanks everyone for your effort!

serveradmin
New Contributor III

As I posted earlier I have already done that. Intermediate certificate is uploaded to Fortigate. Root is also present and .pfx is uploaded as bundle of certificate, intermediate etc.

nobox
New Contributor III

I have the same problem on 7.4 but I discovered that after changing the policy to Flow-based, the certificate is sent in its entirety along with the intermediate one, this is not a solution, but rather a workaround, but always something

daniels7
New Contributor II

We experience the same issue on 7.4 as well. The workaround with using Flow-based instead of Proxy-based works but the Bug should be fixed soon

JasoSmit1
New Contributor

I'm running FortiOS 7.2.6 and had this same issue with the sslvpn site and a GoDaddy (Starfield) intermediate CA certificate.  I inadvertently resolved it while adjusting ciphers to improve SSL Report score from the great Qualys SSL Labs.  I'm not sure why the settings below worked or if applicable to a virtual server but the Fortigate now sends the full certificate chain (and increased my report score from B to A+).

 

config vpn ssl settings
    set banned-cipher RSA DHE DSS CAMELLIA 3DES SHA1 STATIC ARIA AESCCM
    set ciphersuite TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-CCM-SHA256

    set dtls-min-proto-ver dtls1-2

end

 

Update:

After removing the config I added above the issue remains fixed.  It is possible that just adding the intermediate CA is insufficient to fix the issue which also requires the webserver to restart in order see the added certificate.  This is based on the assumption that modifying the vpn ssl settings caused the webserver to restart and see the ICA was present.

Labels
Top Kudoed Authors