Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
grasent
New Contributor

Invalid SSL Cert Only Blocked When IPS Profile Active

I am new to FortiGate and struggling to understand the SSL/SSH Profile functionality.

 

If I understand correctly, the SSL Certificate Inspection (Not fully proxy) has the ability to block invalid and/or expired certificated. However, based on my testing, this only functions correctly if the matching policy has an associated IPS policy (protect client in my case).

 

I cannot find any documentation that explains why this is the case, but have tested multiple times and regardless of the configuration, the SSL profile will never enforce block actions unless an IPS profile is present.

 

Version: FortiGate-VM64 v7.2.0,build1157,220331 (GA.F)

 

4 REPLIES 4
Anthony_E
Community Manager
Community Manager

Hello grasent,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello,

 

We are still looking for an answer to your question.

We will come back to you as soon as we got one.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello,

 

I have found this old Forum post:

 

https://community.fortinet.com/t5/Fortinet-Forum/7-0-4-break-Proxy-inspection/m-p/203875

 

Where you can find some information. Could you please tell me if it helps?

 

Regards,

Anthony-Fortinet Community Team.
grasent

Hi Anthony,

 

Thanks for continuing to look into this! Unfortunately I don't think this describes my problem. I have tested this with both flow and proxy mode for the IPS/SSL profile and the result is the same either way.

Labels
Top Kudoed Authors