I'm a novice with this, but I have web filters enabled and still having trouble reaching a few government sites, for example www.pittsburghca.gov. But others, like [link]https://www.dmv.ca.gov[/link] work fine. I've explicitly allowed the blocked sites and still same error:
This Connection is Invalid. SSL certificate expired.
A secure connection to www.pittsburgca.gov cannot be established.
When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.
Sitewww.pittsburgca.govCertificate CNsan-g2.granicusgovaccess.netCertificate AuthorityR3Certificate Validity Not Before: Sep 20 16:46:45 2021 GMT Not After: Dec 19 16:46:44 2021 GMT
What am I missing? And remember, I'm a real novice with the Fortinet equipment (new job, this is what they had in place) so explain to me like I'm a 5 year old. It's a Fortigate 100E with firmware v7.0.1 build0157 (GA). Thanks!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
it is also posted in the other thread here but to have it complete, after that trick with the DNS blackhole you need to clear the certificate cache most likely.
flow-mode: # diagnose ips share clear cert_verify_cache proxy-mode (process restart will have impact): # diagnose test application wad 99
a true fix will be an actual code change indeed, but with this you can move on without having to lower security.
I'm facing the same problem on OS FortiOS v7.0.1 build0157 (GA)
When I try to change the Flow mode and create a new policy to allow invalid SSL certificates, it still doesn’t work.
Still same problem after tried workaround 1 on fortigate 6.2.9.
Does anyone else get it working on fortigate 6.2?
what is exactly workaround 1? i dont hear any issues at customers at the moment.
https://www.fortinet.com/blog/psirt-blogs/fortinet-and-expiring-lets-encrypt-certificates
Workaround 1 – Prevent fallback to the expired Root CA
config system dns-database edit "1" set domain "identrust.com" config dns-entry edit 1 set hostname "apps" set ip 127.0.0.1 next end next end
Doesn't work with deep inspection policy.
do you have that latest certificate bundle? did you clear the certificate cache afterwards?
Yes, did all of that.
FTG # diagnose autoupdate versions | grep "Certificate Bundle" -A 5 Certificate Bundle --------- Version: 1.00028 Contract Expiry Date: n/a Last Updated using scheduled update on Fri Oct 1 10:20:54 2021 Last Update Attempt: Thu Oct 7 10:21:38 2021
FTG # diag ips share clear cert_verify_cache
tuanccs wrote:
Doesn't work with deep inspection policy.
It's not true. We use deep inspection (proxy mode) everywhere and this workaround works. Jirka
sigmasoftcz wrote:are you on 6.2?
It's not true. We use deep inspection (proxy mode) everywhere and this workaround works. Jirka
We use flow mode
Tuan
I will try workaround 2 tonight, will feedback there, after outcome.
we're on 7.0.1, use proxy mode
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.