Safari versions lower than 7.1 unable to connect securely on FortiGate 100D

[kkirkland]

Recent PCI Compliance guidelines necessitated an upgrade of our Fortigate 100D to Firmware version v5.4.0,build1011 (GA). After doing so we disabled SSLv3 and lower leaving only TLS 1.0, 1.1, and 1.2 over https. We are not using SSL offloading. Ever since, we've been having problems with any version of Safari running on OS X older than Safari 7.1 not being able to establish a secure connection. Initially thought it was a matter of incorrect cipher suites being offered but Qualys SSL labs (https://www.ssllabs.com/ssltest/) is indicating the following suites available:

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)   ECDH sect571r1 (eq. 15360 bits RSA)   FS256TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)   ECDH sect571r1 (eq. 15360 bits RSA)   FS128TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)   ECDH sect571r1 (eq. 15360 bits RSA)   FS128TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)128TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)128TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)128TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)112TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)   ECDH sect571r1 (eq. 15360 bits RSA)   FS128TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)   ECDH sect571r1 (eq. 15360 bits RSA)   FS256TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)   ECDH sect571r1 (eq. 15360 bits RSA)   FS256

Numbers 1 and 3 are supported by Safari 5.1.9 on OSX 10.6.8: https://www.ssllabs.com/ssltest/viewClient.html?name=Safari&version=5.1.9&platform=OS%20X%2010.6.8 so it doesn't appear to be an issue of the wrong cipher suite being loaded. 

When looking at the Fortigate logs the attempt at establishing a https connection can be seen and the following entry is generated: 

Log location: Disk

HA Cluster

/116

[Total: 5794]

#2  Action   close

Date/Time          10:36:24              

Destination         {redacted}

Destination Port               443        

Identity Index   0

Level Log Description SSL minor version is less than configured minimum value

Log ID    45011   

Message              SSL minor below mininum configured value

Min Minor           1             

Policy    44

Received Minor                0             

Serial Number   {redacted}

Source  {redacted}  

Source Port        {redacted}

Sub Type system

Timestamp         3/17/2016, 10:36:24 AM

VIP Preview1-HTTPS              

Virtual Domain  {redacted}

Is there a method of enabling more verbose logging to determine the EXACT nature of why these older Safari connection attempts are being refused (I'm not familiar with CLI?FortiOS unfortunately so specifics would be appreciated). 

Thanks.