Invalid SSL Cert Only Blocked When IPS Profile Active

[grasent]

I am new to FortiGate and struggling to understand the SSL/SSH Profile functionality.

If I understand correctly, the SSL Certificate Inspection (Not fully proxy) has the ability to block invalid and/or expired certificated. However, based on my testing, this only functions correctly if the matching policy has an associated IPS policy (protect client in my case).

I cannot find any documentation that explains why this is the case, but have tested multiple times and regardless of the configuration, the SSL profile will never enforce block actions unless an IPS profile is present.

Version: FortiGate-VM64 v7.2.0,build1157,220331 (GA.F)

[Anthony_E]

Hello grasent,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello,

We are still looking for an answer to your question.

We will come back to you as soon as we got one.

Regards,

[Anthony_E]

Hello,

I have found this old Forum post:

https://community.fortinet.com/t5/Fortinet-Forum/7-0-4-break-Proxy-inspection/m-p/203875

Where you can find some information. Could you please tell me if it helps?

Regards,

[grasent]

Hi Anthony,

Thanks for continuing to look into this! Unfortunately I don't think this describes my problem. I have tested this with both flow and proxy mode for the IPS/SSL profile and the result is the same either way.