fix "Web page blocked"

[6sITdept]

I'm pulling my hair out.
A user in the company is trying to get to a website. however the Fortigate is blocking access to the page. Using Firefox, when I go to the website I get:
- The firefox "potential security risk ahead".
when I click "Advanced..." I get:
- The certificate is not trusted because it is self-signed.
- Error code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
- View Certificate
When I click "View Certificate" I get
- Organization: Fortinet
- Common Name: Fortiguard SDNS Blocked Page
I click "Accept risk and continue" I get to:
- "Fortinet Secure DNS Service Portal" and "Web Page Blocked! You have tried to access a web page which belongs to a category that is blocked. "

Ive checked the site with
https://www.fortiguard.com/webfilter
https://www.fortiguard.com/services/sdns
and the site passed both.

On the firewall I setup a new policy, with the source being my computer, and the destination being the website i'm trying to get to. I turned off all the security polices and put the SSL Inspection to allow everything.
I executed the flushdns. Then i tried to go the site. same result "Website is blocked"

I checked the log and I do see that my computer attempted to connect to the website and it says "Accepted" for HTTP and HTTPS.

My feel is that there is something wrong with getting the certificate with this website. do you agree? if yes what can I do to get the firewall to accept the Certificate.

Thoughts?

[Atul_S]

Hi,

Have you tried importing the cert and saving it in your computer's cert store?

[Dorothy_Olvera]

I think it’s HTTPS interception by the FortiGate - the browser sees a Fortinet cert and blocks the page.
Tip: check the certificate in the browser and the webfilter logs, and run openssl s_client -connect domain:443 -servername domain to verify which cert is served. If needed, add the Fortinet proxy CA to clients’ trusted store (or via GPO), or create an SSL inspection exception/whitelist for the domain, or submit a FortiGuard reclassification request.