Virtual Server with HTTPS healtcheck failing TLS verification

[ronen_beitelmajer]

I am running a Virtual server on my Fortigate 1500D with the following healtcheck:

config firewall ldb-monitor
    edit "PatroniMaster"
        set type https
        set interval 10
        set timeout 2
        set retry 3
        set port 8008
        set src-ip 0.0.0.0
        set http-get "/master"
        set http-match "200 OK"
        set http-max-redirects 0
    next
end

The healtcheck is polling a Patroni service that runs with HTTPS with certificates signed by a private CA.

The private root CA has been loaded to the Global scope of the Fortigate for trust purposes.

The healtcheck is failing due to certificate verification issues.

Tried a few different setups:

1. Server certificate without chain

2. Server certificate with chain

3. Root CA with and without intermediate CA

Tested the Patroni solution with curl from a remote PC and it works as expected:

curl -k $PATRONI_HOST/replica --> returned: curl: (60) SSL certificate problem: unable to get local issuer certificate
curl -k --cacert $PATH_TO_ROOT_CA $PATRONI_HOST/replica --> returned: 200 OK

Some logs from diagnose:

ipldbd::http_send_url(595): HTTP send() failed. errno=5
ipldbd::epoll_mod_event(67):modify epoll event failed! fd=19 errno=9
ipldbd::http_send_url(570): HTTP send get-url="GET /master HTTP/1.1
User-Agent: FortiGate (FortiOS 7.0) Chrome/ Safari/
Cache-Control: no-cache
Pragma: no-cache
Host: $PATRONI_HOST:8008
Keep-Alive: timeout=15
Connection: Keep-Alive
Content-Length: 0

"
ipldbd::http_handle_get_response(526): recv failed mon=PatroniMaster errno=5

Would appreciate some help

Thanks

[filiaks1]

I think the only way could be to use HTTP health monitor and on the backend servers to allow only the fortigate IP address to connect on HTTP. Could not see an option to stop the cert verification for a HTTPS health monitor.

[ronen_beitelmajer]

I tend to agree, although it seems to be like an moderately easy fix, given that Fortigate already supports the use of private CAs for many TLS features. 

Eventually, I changed Patroni to work with HTTP only and added a username:password for API requests. Also allowed networking from the Firewall itself.

[filiaks1]

I am not a Engineer working directly for Forti but seems that just the option is not exposed.