Created on 07-13-2023 02:54 AM Edited on 02-26-2024 05:26 AM By Kate_M
Hi,
I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".
I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
FYI, I downgraded fortios to 6.4.14 and it works! So it seems like it is bug in FortiOS 7.4.0. I will check if the same problem is also on fortios 7.2.5
Created on 07-17-2023 04:59 AM Edited on 07-17-2023 05:00 AM
7.2.5 works aswell. Definitely bug in FortiOS. Thanks everyone for your effort!
As I posted earlier I have already done that. Intermediate certificate is uploaded to Fortigate. Root is also present and .pfx is uploaded as bundle of certificate, intermediate etc.
I have the same problem on 7.4 but I discovered that after changing the policy to Flow-based, the certificate is sent in its entirety along with the intermediate one, this is not a solution, but rather a workaround, but always something
We experience the same issue on 7.4 as well. The workaround with using Flow-based instead of Proxy-based works but the Bug should be fixed soon
I'm running FortiOS 7.2.6 and had this same issue with the sslvpn site and a GoDaddy (Starfield) intermediate CA certificate. I inadvertently resolved it while adjusting ciphers to improve SSL Report score from the great Qualys SSL Labs. I'm not sure why the settings below worked or if applicable to a virtual server but the Fortigate now sends the full certificate chain (and increased my report score from B to A+).
config vpn ssl settings
set banned-cipher RSA DHE DSS CAMELLIA 3DES SHA1 STATIC ARIA AESCCM
set ciphersuite TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-CCM-SHA256
set dtls-min-proto-ver dtls1-2
end
Update:
After removing the config I added above the issue remains fixed. It is possible that just adding the intermediate CA is insufficient to fix the issue which also requires the webserver to restart in order see the added certificate. This is based on the assumption that modifying the vpn ssl settings caused the webserver to restart and see the ICA was present.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.