Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
wafikmaher
New Contributor II

SSL Inspection Untrusted Certificate Issue

F-Gate 5.4.1

Inspection Mode: Proxy-based

Sec Profiles: SSL (full-inspections), Web, Proxy.

Client Firefox: version 46,47,56

Symptoms: All HTTPS connections failing.

Firefox error message: Secure Connection Failed

Packet Sniffer result (attached): Client-to-FG => 3 way handshake ok, Client SSL hello, FG ACK, FG RST. FG-to-Server=> 3-way handshake

Debug WAD (attached): Failing to load default Untrusted Certificate

Workaround: Use the Fortinet_CA_SSL default certificate (which is by default used for trusted re-sign) for untrusted as well, however this will work

Solution (1): Regenerate the default Untrusted Certificate (not sure if possible). Solution (2): Generate a new self-signed certificate for the Untrusted Certificate (not sure if possible). Solution (3): Generate a new CA-signed certificate for the Untrusted Certificate.

1 Solution
wafikmaher

Hi Elthon,

i used "diagnose debug application wad 255", you can also use "diagnose debug application wad 130" which is more compact.

Regards,

Wafik

View solution in original post

6 REPLIES 6
Elthon_Abreu
Contributor

Hi wafikmaher,

 

How did you get the WAD output? Wich command did you have used?

Elthon Abreu FCNSA v5

Elthon Abreu FCNSA v5
wafikmaher

Hi Elthon,

i used "diagnose debug application wad 255", you can also use "diagnose debug application wad 130" which is more compact.

Regards,

Wafik

blackhole_route
New Contributor III

If you're still on 5.4.1 and doing web-filtering and ssl interception, I would suggest you consider upgrading to a more recent version (5.4.5 has been pretty stable for us in the 5.4 release). IIRC, we saw some very strange ssl signing issues when 5.4.1 was first released. 5.4.4 and then 5.4.5 were much more stable for our deployment doing webfiltering and a small amount of ssl interception.

wafikmaher

Thanks Blackhole.

However this is a course lab, which need to run on certain release, so was hoping to find an easy workaround which makes sense on the same release, by replacing the build-in untrusted with a true self-signed (not CA signed) certificate, which is still don't know if supported on F-Gate, and how.. Will try to upgrade and test the lab on 5.4.5.

 

 

Baptiste

Hi you can check or change Untrust Ca on SSL Profile

 

Check 

config firewall ssl-ssh-profile edit *profile name*

get

 

Change

config firewall ssl-ssh-profile edit *profile name* set untrusted-caname *your cert" end

2 FGT 100D  + FTK200

3 FGT 60E  FAZ VM  some FAP 210B/221C/223C/321C/421E

2 FGT 100D + FTK200 3 FGT 60E FAZ VM some FAP 210B/221C/223C/321C/421E
wafikmaher
New Contributor II

Thank you Baptiste,

What you mentioned is definitely required, but this is the second step. First step is to provide a replacement Cert, CA-Signed or self-signed. After that you can point to it, and the config you post shows this. The way i know, and that all Fortinet documents came across me show,  was to use a CA-signed only, some Fortinet documents call the private CA-signed cert, self-signed which is not correct. I was thinking (or hoping) that there is a way to make a REAL Self-Signed cert (without any external CA private or public), thats what i was asking for in my post.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors