PCI Non Compliance HTTP/1.0 Protocol Downgrade Detected

[jeff363]

How do I Configure server to reject HTTP/1.0 requests with "505 HTTP Version Not Supported" status and enforce minimum HTTP/1.1 protocol version?  I am using Fortigate 60f and I need to make necessary changes so that my Merchant Service PCI Compliance passes.  This is the last setup that I need and would like to make the fix with GUI, not CLI.  Any help would be great appreciated.

[Toshi_Esumi]

One of our customers reported the same pentest failed report due to the same "HTTP/1.0" issue (the report says HTTP/1.1 is still unacceptable, while only HTTP/2 and /3 are acceptable) against their VDOM serving SSL VPN with 7.2.12. Since I couldn't find a good way to "silence" this, we opened a TAC case 10 days ago. TAC's initial response was:
"The reported behavior has been escalated to our PSIRT team, and we are currently awaiting a status update. Any feedback received from then will be shared through this ticket."
And, we still haven't gotten any update from them yet. Since they didn't come back and say "you have to upgrade to 7.4.x or 7.6.x", I'm assuming upgrading it to a newer generation wouldn't resolve this issue. 

Toshi

[Toshi_Esumi]

We just got an update from them via the ticket. It says:
"... our development team is currently working on a fix for the reported issue under bug#1240901..."
Not sure this bug ID is directly for this particular issue. But at least implementing a change or changes to address this issue. In other words, it wouldn't be resolved until a new release(s) with this fix comes out.

Toshi

[ag5]

Is there an update on this issue?  We are experiencing the same issue.  We are running on a Fortigate 400F ver7.2.11 Build 1740.  Thanks

[TMalik]

Just had our monthly Pen test fail on the same issue. HTTP/1.0 Protocol Downgrade Detected found at PORT: 10443. v 7.0.18 build 0695. 200E

Any update from the PSIRT team?

[Sandman7391]

Same issue here. “HTTP/1.0 Protocol Downgrade Detected found at PORT: 443”

100f v7.4.9 build2829.

[Matt_B]

Qualsys added and updated some signatures in November 2025, see QID 530600 in their bulletin here https://notifications.qualys.com/product/2025/11/28/application-security-detections-published-in-nov....

SSLVPN/Agentless VPN on all current FortiOS versions including v7.2.12, v7.4.9, and v7.6.5 would be affected by the signature change and start to show warnings on any PCI Compliance scan using Qualsys or tools with similar signatures.

While 1240901 is an internal issue number requesting an update to SSL VPN to allow blocking HTTP/1.0 requests, there is no current schedule to include a fix in v7.2 or v7.4. If there will be a FOS-side change to resolve the fix these branches, it is likely not soon. I mention those branches specifically since SSL VPN tunnel mode is removed in FortiOS v7.6.3 SSL VPN tunnel mode replaced with IPsec VPN.

For any of my customers who are able, I'm recommending expedited migration to IPsec VPN in order to disable SSL VPN and avoid this issue. Obviously that's not an appropriate solution for all environments.

[cvc_lukes]

My scan reported the same thing. So looking to see if there might be an ETA to Fortinet rolling a fix as I know removing SSL VPN isn't exactly an option for my company at this time. 

[Toshi_Esumi]

We got an update on our ticket saying it would be in "7.4.11(no ETA), 7.6.6(ETA-April), 8.0.0(ETA-March)". 

Since 7.4.10 just came out yesterday, 7.4.11 would be like 3-4 months away. 8.0.0 might be the first to be available. But then SSLVPN wouldn't work for 7.6.6 and 8.0.0 anyway.
So FTNT really wants everybody out of SSLVPN, I guess.

Toshi