Intermediate certificate

[serveradmin]

Hi,

I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".

I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

[serveradmin]

7.2.5 works aswell. Definitely bug in FortiOS. Thanks everyone for your effort!

[serveradmin]

As I posted earlier I have already done that. Intermediate certificate is uploaded to Fortigate. Root is also present and .pfx is uploaded as bundle of certificate, intermediate etc.

[nobox]

I have the same problem on 7.4 but I discovered that after changing the policy to Flow-based, the certificate is sent in its entirety along with the intermediate one, this is not a solution, but rather a workaround, but always something

[daniels7]

We experience the same issue on 7.4 as well. The workaround with using Flow-based instead of Proxy-based works but the Bug should be fixed soon

[JasoSmit1]

I'm running FortiOS 7.2.6 and had this same issue with the sslvpn site and a GoDaddy (Starfield) intermediate CA certificate.  I inadvertently resolved it while adjusting ciphers to improve SSL Report score from the great Qualys SSL Labs.  I'm not sure why the settings below worked or if applicable to a virtual server but the Fortigate now sends the full certificate chain (and increased my report score from B to A+).

config vpn ssl settings
    set banned-cipher RSA DHE DSS CAMELLIA 3DES SHA1 STATIC ARIA AESCCM
    set ciphersuite TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256 TLS-AES-128-CCM-SHA256

    set dtls-min-proto-ver dtls1-2

end

Update:

After removing the config I added above the issue remains fixed.  It is possible that just adding the intermediate CA is insufficient to fix the issue which also requires the webserver to restart in order see the added certificate.  This is based on the assumption that modifying the vpn ssl settings caused the webserver to restart and see the ICA was present.

[eriksornes]

I'm runnig fortigate 7.4.9 with fortimangaer 7.4.8 and JasoSmit1 exact settings worked for me. Now the whole of the sslvpn certifcate chain is passed through. Now there are no untrusted certificate warnigns and also openssl s_client connect server.domain:port returns whole chain. Before on 7.4.9 it was problem. No certificate chaing with openssl s_client connect (only host certificate) and "untrusted certificate"-warning with forticlient (7.4.3 on ubuntu 22.04/24.04 and android). Thanx alot. I opened a supportcase with Fortinet on this, and will report the findings and refer to this post. 

I have not currently tried to reset the settings. We also have another environment with same problem on fortigate 7.2.12, but in fear of disconnecting users, changes there must wait a few weeks.

[5Lights]

done suppose you got anywhere with this?