website access problems

[unknown1020]

good afternoon colleagues, a question.
In the morning we had some problems with access to some pages that I could access normally.

In order to pass the certificate analysis I had to enter the rule and in the SSL INSPETION section change from certificate-inspection to no inspection until the page loads without problems and then return to certificate-inspection.

This problem has been occurring with other pages that were previously accessed.

the connection is not private

It is possible that attackers are trying to steal your information from xxxxx.com
(for example, passwords, messages or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID

It is worth mentioning that when you enter through another network, for example, a cellular data network or a home network, if you can access the page and the message "it is not secure" does not appear.

Do you know why this happens?

It is worth mentioning that the certificate of the page expires in 2024 so there should be no problem.

[YBKruthi · Accepted solution]

Hi,

The error message "NET::ERR_CERT_AUTHORITY_INVALID" typically occurs in web browsers like Google Chrome and Mozilla Firefox when there is an issue with the SSL/TLS certificate of a website.

When the browser encounters an invalid certificate authority, it means that the SSL/TLS certificate presented by the website cannot be verified with a trusted certificate authority. There are a few common reasons why this error might occur:

1) Expired or Invalid Certificate: The SSL/TLS certificate may have expired or is otherwise considered invalid by the browser.

2) Self-Signed Certificate: The website is using a self-signed certificate instead of one issued by a recognized certificate authority. Self-signed certificates are not trusted by default in most browsers.

3) Mismatched Domain: The certificate is issued for a different domain or subdomain than the one you are trying to access, causing a domain mismatch.

4) Misconfigured Certificate Chain: The certificate chain provided by the server is incomplete or not properly configured.

5) Untrusted Certificate Authority: The certificate authority that issued the certificate is not recognized or trusted by the browser.

6) Root Certificate Updates: Sometimes, a user's browser may need updates to its root certificate store, which contains the list of trusted certificate authorities.

So, please confirm by installing the certificate on the client machine and allowing it to trust it initially, this will clarify you to narrow down the issue.

Regards,

Kruthi

[knalawade]

Please try to install the certificate on local machine in browser under trusted root certificate and check it.

Regards,

kunal

[unknown1020]

but why? If the certificate of those pages expires in one year, there are also several users who have the problem

[YBKruthi · Accepted solution]

Hi,

The error message "NET::ERR_CERT_AUTHORITY_INVALID" typically occurs in web browsers like Google Chrome and Mozilla Firefox when there is an issue with the SSL/TLS certificate of a website.

When the browser encounters an invalid certificate authority, it means that the SSL/TLS certificate presented by the website cannot be verified with a trusted certificate authority. There are a few common reasons why this error might occur:

1) Expired or Invalid Certificate: The SSL/TLS certificate may have expired or is otherwise considered invalid by the browser.

2) Self-Signed Certificate: The website is using a self-signed certificate instead of one issued by a recognized certificate authority. Self-signed certificates are not trusted by default in most browsers.

3) Mismatched Domain: The certificate is issued for a different domain or subdomain than the one you are trying to access, causing a domain mismatch.

4) Misconfigured Certificate Chain: The certificate chain provided by the server is incomplete or not properly configured.

5) Untrusted Certificate Authority: The certificate authority that issued the certificate is not recognized or trusted by the browser.

6) Root Certificate Updates: Sometimes, a user's browser may need updates to its root certificate store, which contains the list of trusted certificate authorities.

So, please confirm by installing the certificate on the client machine and allowing it to trust it initially, this will clarify you to narrow down the issue.

Regards,

Kruthi

[unknown1020]

Hello, thanks for answering. Excuse me and how do I get the certificate? Does the owner of the page have to give it to me?

[pgautam]

Hi

Certificate Inspection should not break any SSL connections. The Fortigate only inspects the SNI on the Client Hello or the Server Certificate when Certificate Inspection is used. It does not attempt a MitM.

Could you post the output of the CLI commands, "config firewall ssl-ssh-profile", "edit <your profile>", "show"?
This is the default certificate-inspection profile.

Along with the certificate profile please collect the wireshark from the test machine to check the issue.

Regards

Priyanka

[unknown1020]

Hello, the default profile is being used:

edit "certificate-inspection"
set comment "Read-only SSL handshake inspection profile."
config https
set ports 443
set status certificate-inspection
end
config ftps
set status disable
end
config imaps
set status disable
end
config pop3s
set status disable
end
config smtps
set status disable
end
config ssh
set ports 22
set status disable
end
config dot
set status disable
end

One question, what option is causing those messages to appear when you want to access those pages? I would like to disable that option without having to change the certificate-inspection profile

the connection is not private

It is possible that attackers are trying to steal your information from xxxxx.com
(for example, passwords, messages or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID

[srajeswaran]

On your SSL inspection profile, under Trusted CA list, do you see the CA for the specific certificate in question? If not, that is the most possible reason for this error.

[unknown1020]

then if the CA of the certificate is not in that list of the certificate-inspection profile. What option should I disable in that profile so that when trying to access those pages those messages no longer appear?

the connection is not private

It is possible that attackers are trying to steal your information from xxxxx.com

(for example, passwords, messages or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID

[Markus_M]

Hi,

maybe this helps to understand certificates better:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-TLS-and-the-use-of-Digital-Certificates/ta...

in very short: certificates are supposed to come in a chain. The webserver has a server certificate, which is signed by a CA (CERT_AUTHORITY) certificate and that is usually signed by another CA.

The webserver is supposed to send the webserver certificate and the CA certificates that signed that webserver certificate.

The client, your browser is supposed to receive the certificates and build the chain complete -

server > signing CA (intermediate CA) > signing CA (root CA)

If that fails because the server only sends the server certificate and nothing else, the client may be unable to complete the chain. The error is presented: NET::ERR_CERT_AUTHORITY_INVALID

The "server" certificate is coming from a webserver which is either

- the actual webserver, like https://www.fortinet.com

OR

- if your FortiGate is using SSL deep inspection on that same firewall policy, then the FortiGate has to play being the webserver instead, creating its own chain.

The same chain principle applies and every SSL client, needs to be able to complete the certificate chain. If FortiGate is doing deep inspection you need to download its CA certificate (see the respective DPI profile) and install it on the client. If FortiGate is NOT doing deep inspection, then you need to contact the webserver administrator. That is not to give you the certificate, but to fix the webserver.

Any(!) public webserver is supposed to send certificates as per description above. There might be special cases, but the administrator would have instructed you then for sure.

Best regards,

Markus