SSL Inspection not working anymore

[rezafathi]

Hi

We have a 200F FortiGate with 7.6.1 firmware. I have set up ssl inspection, web filter, ips and antivirus about 2 years ago and all of them were working fine till last week. I noticed that there is no fortinet issuer in any website I open and because of that all websites are permitted and no application blocking is occurred. I have used Fortinet_CA_SSL certificate (default) via group policy for users and that was working. please help me to solve this issue

[AEK]

Hi Reza

Does it work with proxy based rule?

[Dhruvin_patel]

Greetings!

It sounds like SSL inspection isn't being applied properly, which is why the Fortinet certificate isn't showing up and your web filtering and application controls aren't taking effect.

Please ensure that the traffic is passing through the correct policy.

Ensure SSL inspection is still enabled on the relevant policies.

Verify that the correct inspection profile (deep or certificate inspection) is applied.

Regards!

[rezafathi]

It only works in proxy mode now. But another wiered thing happened. When i add some websites in full ssl inspection policy, the ssl inspection become disable and there won't be fortinet CA in any websites but when i delete that websites it works perfectly.why?

[Dhruvin_patel]

Actually when using deep packet inspection on a FortiGate, the recommended inspection mode is "proxy inspection mode" as it provides the most comprehensive analysis of traffic.

As you are using flow-based inspection mode with deep packet inspection, I would suggest to check this document, https://community.fortinet.com/t5/FortiGate/Technical-Tip-ERR-SSL-PROTOCOL-ERROR-when-using-Flow-bas...

It is a known issue related to ML-KEM post-quantum TLS key exchange.

Regards! 

[rezafathi]

I am not using flow mode i am uaing proxy mode now. Evwrything is setup correctly but when i add some websites for ssl inspection bypass , the ssl inspection not working anymore

[dingjerry_FTNT]

Hi @rezafathi ,

You may use the debug flow commands to find out this interesting traffic is hitting which firewall policy, then double check whether the SSL Inspection profile is applied correctly or not in this policy.