So, we're having an issue with out outlook clients popping up a certificate warning and having to reconnect several times a day. The certificate is the factory default, not the SSL certificate we have configured for deep inspection. Fortinet support has not been able to help us and keeps trying to reinstall the SSL certificate (used for deep inspection) on the affected computers. After looking through the logs I noticed we have SSL anomalies on some traffic to Microsoft. It seems the certificates they are using for several of their web servers are valid with a date of over 1 year, however, fortigate responds back that the certificate is "re-signed as untrusted, certificate-status: untrusted". I've tried using my cell phone with the same URL and it says "server certificate could not be trusted", chrome on an internal PC (after microsoft SSL exemption) now says, "NET::ERR_CERT_VALIDITY_TOO_LONG". Which reaffirms my belief that the SSL cert is valid for too long now and is causing the error. This would require microsoft to re-key all of these SSL certs...
The certificate being used by microsoft is longer than 1 year. Not sure if the rules regarding SSL/TLS certificates being valid for only 1 year is affecting how browsers and the fortigate see this certificate as being untrusted.
Why the fortigate is then using the factory default certificate for ssl inspection might be by design. But I'm not sure on this. The SSL error can be reproduced outside and inside my network, so I don't think its a fortigate issue. I've exempted microsoft sites from being SSL inspection, and i'll see if I get the outlook popup again.
By default, with SSL deep-inspection when FGT fails to authenticate the server certificate (i.e. untrusted root CA, expired, self-signed certificate) it will resign the certificate with "Fortinet_CA_Untrusted". In CLI you can configure it as follows: config firewall ssl-ssh-profile
set untrusted-caname "Fortinet_CA_Untrusted" ----> You can select different cert here
based on the firmware version, there are a couple of additional settings on what to do when untrusted cert is received, for example in 7.0.5: config firewall ssl-ssh-profile edit "test" config https set ports 443 set status deep-inspection set expired-server-cert block set revoked-server-cert block set untrusted-server-cert allow set cert-validation-timeout allow set cert-validation-failure block
Thanks for the information. I made those changes above and we still get the error. I even exempted the sites and we still got the error. Fortinet support said the problem may have to do with the WAD crashes on signal 11 unresolved issue on 7.05. It would still block the sites after the crash even though exempted. I did a work around and removed SSL deep inspection for all Microsoft sites. So far so good. We'll see if that narrows the problem down. If so, then upgrading to 7.2 will fix the numerous WAD problems in version 7.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.