SSL-Inspection does not excepmt DDNS FQDN FortiOS 7.4.9

[MG4]

Hello everyone,

I tried to exempt an DDNS FQDN, but it still gets blocked by the FortiGate.

SSL-Log:
SSL connection is blocked, certificate-status: expired untrusted

I tried with an Address FQDN object and also via this method https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-Exemption-based-on-FQDN-in-Proxy-based... .

The connection to the FQDN still gets blocked. I also have to add we are using a different HTTPS port to reach the address (3438) and yes the remote certificate is expired since it came with the device.

[Atul_S]

Hi,

Fortigate will enforce the cert validation prior to SSL exemption. Pls consider disable the cert inspection. Also create the custom port for https as below:

config firewall ssl-ssh-profile

edit <name>

set ports 443 3438

next

end

See if this works.

Thanks,

[MG4]

Hello,

why does it work, if we add the current IPv4-Address of the DDNS FQDN to the exempts? Why does it not work for FQDNs?

The FortiGate can resolve the IP of the FQDN, but the exempt does not work with only the FQDN as an exempt. It only works when we look the address up ourselves and adding it manually.

Turning off cert inspection would fix the problem, but that would also lower the security to other websites.