So, we're having an issue with out outlook clients popping up a certificate warning and having to reconnect several times a day. The certificate is the factory default, not the SSL certificate we have configured for deep inspection. Fortinet support has not been able to help us and keeps trying to reinstall the SSL certificate (used for deep inspection) on the affected computers. After looking through the logs I noticed we have SSL anomalies on some traffic to Microsoft. It seems the certificates they are using for several of their web servers are valid with a date of over 1 year, however, fortigate responds back that the certificate is "re-signed as untrusted, certificate-status: untrusted". I've tried using my cell phone with the same URL and it says "server certificate could not be trusted", chrome on an internal PC (after microsoft SSL exemption) now says, "NET::ERR_CERT_VALIDITY_TOO_LONG". Which reaffirms my belief that the SSL cert is valid for too long now and is causing the error. This would require microsoft to re-key all of these SSL certs...
The certificate being used by microsoft is longer than 1 year. Not sure if the rules regarding SSL/TLS certificates being valid for only 1 year is affecting how browsers and the fortigate see this certificate as being untrusted.
Why the fortigate is then using the factory default certificate for ssl inspection might be by design. But I'm not sure on this. The SSL error can be reproduced outside and inside my network, so I don't think its a fortigate issue. I've exempted microsoft sites from being SSL inspection, and i'll see if I get the outlook popup again.
“When things go wrong, don't go with them.”