Created on 07-13-2023 02:54 AM Edited on 02-26-2024 05:26 AM By Kate_M
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Intermediate certificate
Hi,
I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".
I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.
Solved! Go to Solution.
- Labels:
-
Certificate
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
FYI, I downgraded fortios to 6.4.14 and it works! So it seems like it is bug in FortiOS 7.4.0. I will check if the same problem is also on fortios 7.2.5
- « Previous
- Next »
Created on 07-17-2023 04:59 AM Edited on 07-17-2023 05:00 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
7.2.5 works aswell. Definitely bug in FortiOS. Thanks everyone for your effort!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I posted earlier I have already done that. Intermediate certificate is uploaded to Fortigate. Root is also present and .pfx is uploaded as bundle of certificate, intermediate etc.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the same problem on 7.4 but I discovered that after changing the policy to Flow-based, the certificate is sent in its entirety along with the intermediate one, this is not a solution, but rather a workaround, but always something
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We experience the same issue on 7.4 as well. The workaround with using Flow-based instead of Proxy-based works but the Bug should be fixed soon
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm running FortiOS 7.2.6 and had this same issue with the sslvpn site and a GoDaddy (Starfield) intermediate CA certificate. I inadvertently resolved it while adjusting ciphers to improve SSL Report score from the great Qualys SSL Labs. I'm not sure why the settings below worked or if applicable to a virtual server but the Fortigate now sends the full certificate chain (and increased my report score from B to A+).
config vpn ssl settings
set banned-cipher RSA DHE DSS CAMELLIA 3DES SHA1 STATIC ARIA AESCCM
set ciphersuite TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-CCM-SHA256
set dtls-min-proto-ver dtls1-2
end
Update:
After removing the config I added above the issue remains fixed. It is possible that just adding the intermediate CA is insufficient to fix the issue which also requires the webserver to restart in order see the added certificate. This is based on the assumption that modifying the vpn ssl settings caused the webserver to restart and see the ICA was present.
- « Previous
- Next »