SSL VPN to internal site: SSL_ERROR_SSL

[ricardok]

Dear Fortigate Users, We have to give an internal Application (website) to externals users. For that, we use fortigate 100D, with SSL VPN and WebMode. Because of some security issues we had to update our fortigate to version v5.2.11,build754 (GA). After that, the fortigate doesn't allow anymore the SSL Certifikate  and shows the error: [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1) [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1) [2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1) The application is hosted by a cooperate partner and will be closed in a couple of months, So, they won't renew the cert. But, for the externals it is important, to have access to this page. My question: is there a possibility to allow this cert? I tried to insert the website to "SSL/SSH Inspection" as an "Exempt from SSL Inspection" and included ssl inspection to the firewall rule, but it didn't work. Thank you for some hints

[EMES]

Was SSL/SSH Inspection profile configured on policies or did you just try to add them? If you create a policy allowing any any using no security profiles does it work? Can you possibly add a screen shot of the certificate error the users are seeing?

[ricardok]

I created a Insepction Profile and added the internal page as "Exempt from SSL Inspection". After that, I included this Profile into the IPv4-Policy, which allows the the Webbased SSL VPN users to access the page.

We also tried give access to some other internal pages with the same rule without problems.

Our users get the normal (browser-)message, that the page (SSL VPN Portal) is not reachable, but only when they try to open the page with the old cert. They have access to all other pages by the portal. It is the same configuration.

The only helpfull debug Ican see, I posted in my starting post:

[2158:root:283]0x2a9909e800 SSL_ERROR_SSL:error:00000001:lib(0):func(0):reason(1)

[EMES]

If you remove the inspection profile then SSL Decryption of that traffic stops. if you do that and the problem continues then it may not be the decryption try removing all profiles and test. Maybe another proxy process in the fortigate is stepping on the traffic.

[ricardok]

Yes, the traffic stops with and without inspection profile. Let me try to explain. I have one rule for SSL-VPN Traffic, with multiple destination (webpages). It's the same configuration, only the destination changes. The only differences are the URL, and the certificate. Some are working, one not. Which process could stop the traffic? The only debug error says SSL_ERROR (s.a.).