SSL-VPN Web Portal breaks after 7.4.8 upgrade on 2GB models

[Rino_B]

Hi there,

On entry-level FortiGate models, the SSL-VPN web portal breaks after the update to FortiOS 7.4.8.

Update 2

diagnose debug console timestamp enable
diagnose debug application sslvpn -1
diagnose debug application fnbamd -1
diagnose debug enable

2025-06-05 11:17:43 [17810:root:4]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin
2025-06-05 11:17:43 [17810:root:4]sslvpn_zip_handler:136 sslvpn check path failed.
2025-06-05 11:17:43 [17810:root:4]fsv_check_path_passed:997 No access: check path failed /migadmin/sslvpn/css/ssl_style.css, /data/migadmin/sslvpn/css, /migadmin/sslvpn/css
2025-06-05 11:17:43 [17810:root:4]sslvpn_zip_handler:136 sslvpn check path failed.

Update 3

The issue has been identified as BUG ID 1164811: https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/236526/known-issues

[Rino_B]

I sent you an email with a sample config

[BillH_FTNT]

Hi Rino;

I got your configuration. Me or our colleagues will reproduce and investigate the issue in our labs. Thank you

Bill

[GerryU]

Hello all, same here

@BillH_FTNT can I send you my config file?
Working on a 60F

Funny enough, I have upgraded to 7.4.8 start of May, did work last time I checked, 3 weeks ago... This is the 1st I hear of this same issue.

[BillH_FTNT]

Hi GerryU

I am preparing the lab to reproduce and investigate your issue. I will share the results here . Thank you.

Bill

[jweberhofer]

WE are having the same issue with a 60F since the update. Other similar models don't seem to have this issue. Here some lines from my client-log:

[info] Server init() port number is
[info] Fail to retrieve port number from file.
[info] Server init() port number is 37913
[info] Main process - Websocket open ws://127.0.0.1:37913/websocket
[info] WindowManager handlePossibleProtocolLauncherArgs argv=["/opt/forticlient/gui/FortiClient"]
[info] WindowManager handleCreateMainWindow
[info] MAIN MainWindow - createWindow Platform detected: fedora
[info] web-contents-created contents.id=1
[info] Saml - init
[info] Saml - listenSamlLoginRequest
[info] Server init() port number is 37913
[info] Renderer process - Websocket open ws://127.0.0.1:37913/websocket
[info] compliance configDir=/home/web/.config/FortiClient/config
[info] MAIN did-finish-load
[info] MAIN ready-to-show
[info] IPC_RENDERER_REQUEST.LOADED
[info] WindowManager handleWindowLoaded
[info] WindowManager handlePossibleProtocolLauncherArgs argv=["/opt/forticlient/gui/FortiClient"]
[info] WindowManager handleCreateMainWindow
[debug] Receive websocket type=FCT_VPN_DISCONNECTED
[debug] Receive websocket type=FCT_VPN_CONNECTING
[info] VpnHandler UNHANDLED {"isTrusted":true}
[debug] Receive websocket type=FCT_VPN_INVALID_CERTIFICATE
[info] VpnHandler UNHANDLED {"isTrusted":true}
[debug] Receive websocket type=FCT_VPN_DISCONNECTED
[debug] Receive websocket type=FCT_VPN_CONNECTING
[info] VpnHandler UNHANDLED {"isTrusted":true}
[debug] Receive websocket type=FCT_VPN_INVALID_CERTIFICATE
[info] VpnHandler UNHANDLED {"isTrusted":true}
[debug] Receive websocket type=FCT_VPN_DISCONNECTED

[jweberhofer]

It's not only the portal, also the tunneling mode is broken.

[Rino_B]

We have no issues with Tunnel Mode but only with Web Mode.

Windows 11 24H2 26100.4061

FortiClient VPN 7.2.10.1217

[BillH_FTNT]

Hi jweberhofer, 

This is good information, We will cross-check this invalid certificate in our lab too. 

Thanks

Bill

[jweberhofer]

The (selected) certificate is definitely valid, it has been issued by letsencrypt. I have also replace it by a valid certificate from another CERT. Didn't change anything.

[BillH_FTNT]

Yeah, I understand what you mean. What I’m trying to say is that I need to check why a valid certificate is being marked as invalid during the process

Regards

Bill