Mobile application showing certificate error

[AEK]

Hi FortiWeb admins

I have a fresh FortiWeb 7.2.8 installation, protecting a Web server for mobile applications.

Public certificate correctly installed on FortiWeb with certificate chain.

I have the following behavior:

1. When Web server is protected by FortiWeb:
   • Web browser trusts the public certificate and doesn't show certificate warning
   • Mobile application shows handshake error
2. When we expose the Web server directly without FortiWeb protection (just behind firewall):
   • Web browser trusts the public certificate and doesn't show certificate warning
   • Mobile application trusts the public certificate and doesn't show handshake error

The handshake error is displayed here below:

I deduce that something on FortiWeb makes the certificate trusted for Web browsers but not for Mobile applications.

Anyone has seen such behavior?

[AEK]

That was obvious, the certificate chain was missing in the certificate installed on FortiWeb.

The solution is simply by replacing the certificate on FWB by the whole certificate chain.

Mobile apps usually require to see the whole chain on the server, while Web browsers don't.