SSL Certificates Error for Protecting SSL Server

[3RR0R]

Hello

I'm trying to set up a SSL Inspection Profile for a Server behind our Fortigate but as soon as I activate the SSL Profile I get an error for the Website that it's not been trusted. SSL Inspection Options is set to Protecting SSL Server.

If I activate the SSL Profile on the Policy and check on https://www.digicert.com/help/ I get following error:

"The Certificate is not issued by DigiCert, GeoTrust, Thawte, or RapidSSL" and the Serial Number which is shown for the Certificate I can't find under Certificates

I uploaded the Wildcard Certificate with Private Key to the Local Certificate and I can see it there. I also see the Intermediate Cert in the Remote CA Cerificate section. Do I have to upload the Root Cert as Remote Certificate to work or what could be the Problem?

I would appreciate your help!

[AEK]

Hi

• In your SSL profile, did you select the right certificate as "Server Certificate"?
• When you get certificate warning on your browser, click on certificate information, do you see DigiCert as issuer name / verified by?
• Do you have the whole certificate chain in the certificate file that you installed on the you FortiGate? (you can check the certificate properties in menu System > Certificates)
• Have you tried with a client other than Android? (Windows or Linux PC)

[3RR0R]

Hi
Yes I did select the right Certificate in the Profile.
I also tried with different Browsers. In the Certificate Viewer on the Browser it says that the Certificate was issued by Fortinet. Even though I  selected the Server Certificate I uploaded.

I uploaded the Wildcard Certificate by itself. Do I have to upload the whole Certificate Chain in one File to the Fortigate?

Thank you

[AEK]

Hi

Then this is not a certificate chain issue. If your browser said it is using Fortinet issued certificate then the traffic is probably handled by a policy that is not using the right SSL profile.

• Ensure that the right policy is matching the incoming traffic (check in traffic log)
• When doing some change try from a private browser window to ensure that it doesn't use the cache

On the other hand (but this is not the cause of your issue), as per my knowledge, usually public certificates are provided with the whole certificate chain in one file. Just check your certificate properties under FGT menu/ System > Certificates). Otherwise it is better to upload it since not all client types accept a certificate without the whole chain.

[3RR0R]

I uploaded the whole Certificate Chain now and in the Log I can see that it takes the right Policy. As soon as I activate the SSL Profile with the Certificate the Website doesn't "work" anymore. If I check the Certificate it shows me a Fortinet Cert but the Serialnumber of this Certificate I can't even find under Certificates.
Also If I check https://www.digicert.com/help/ it shows me "The Certificate is not issued by DigiCert, GeoTrust, Thawte, or RapidSSL" and also some Serialnumber I don't know.

[AEK]

Which FortiOS version?

Can you also post a screenshot of both your SSL inspection profile and the firewall policy?

[3RR0R]

We have FortiOS 7.2.4
Following the SSL Profile and the FW Policy

[3RR0R]

If I check the Website after I activate the Firewall Rule with SSL Profile I see this:

If I check the site on https://www.digicert.com/help/ I get following error. Also the Serialnumber which is shown I can't find in the Certificate Section on the Fortigate

[AEK]

There are some related issues fixed in later patches.

First I'd recommend to patch your FortiGate to 7.2.7.

884578 - Unexpected behavior in WAD caused by enabling HTTP/2 while using virtual servers.
895962 - Intermittent behavior in WAD during SSL renegotiation while using virtual servers. 
853864 - FortiGate out-of-band certificate check issue occurs in a proxy mode policy with SSL inspection.

[3RR0R]

Yes Sorry my bad I misstyped we are on Version 7.2.7