Some .gov sites blocked, others are not?

[adder666]

I'm a novice with this, but I have web filters enabled and still having trouble reaching a few government sites, for example www.pittsburghca.gov. But others, like [link]https://www.dmv.ca.gov[/link] work fine. I've explicitly allowed the blocked sites and still same error:

This Connection is Invalid. SSL certificate expired.

A secure connection to www.pittsburgca.gov cannot be established.

When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

Sitewww.pittsburgca.govCertificate CNsan-g2.granicusgovaccess.netCertificate AuthorityR3Certificate Validity Not Before: Sep 20 16:46:45 2021 GMT Not After: Dec 19 16:46:44 2021 GMT

What am I missing? And remember, I'm a real novice with the Fortinet equipment (new job, this is what they had in place) so explain to me like I'm a 5 year old. It's a Fortigate 100E with firmware v7.0.1 build0157 (GA). Thanks!

[boneyard]

it is also posted in the other thread here but to have it complete, after that trick with the DNS blackhole you need to clear the certificate cache most likely.

flow-mode: # diagnose ips share clear cert_verify_cache proxy-mode (process restart will have impact): # diagnose test application wad 99

a true fix will be an actual code change indeed, but with this you can move on without having to lower security.

[frank0957]

I'm facing the same problem on OS FortiOS v7.0.1 build0157 (GA)

When I try to change the Flow mode and create a new policy to allow invalid SSL certificates, it still doesn’t work.

[tuanccs]

Still same problem after tried workaround 1 on fortigate 6.2.9.

Does anyone else get it working on fortigate 6.2?

[boneyard]

what is exactly workaround 1? i dont hear any issues at customers at the moment.

[tuanccs]

https://www.fortinet.com/blog/psirt-blogs/fortinet-and-expiring-lets-encrypt-certificates

Workaround 1 – Prevent fallback to the expired Root CA

config system dns-database     edit "1"         set domain "identrust.com"         config dns-entry             edit 1                 set hostname "apps"                 set ip 127.0.0.1             next         end     next end

Doesn't work with deep inspection policy.

[boneyard]

do you have that latest certificate bundle? did you clear the certificate cache afterwards?

[tuanccs]

Yes, did all of that.

FTG # diagnose autoupdate versions | grep "Certificate Bundle" -A 5 Certificate Bundle --------- Version: 1.00028 Contract Expiry Date: n/a Last Updated using scheduled update on Fri Oct 1 10:20:54 2021 Last Update Attempt: Thu Oct 7 10:21:38 2021

FTG # diag ips share clear cert_verify_cache

[Jirka1]

tuanccs wrote:

Doesn't work with deep inspection policy.

It's not true. We use deep inspection (proxy mode) everywhere and this workaround works. Jirka

[tuanccs]

sigmasoftcz wrote:

It's not true. We use deep inspection (proxy mode) everywhere and this workaround works. Jirka

are you on 6.2?

We use flow mode

Tuan

[frank0957]

I will try workaround 2 tonight, will feedback there, after outcome.

we're on 7.0.1, use proxy mode