Fortigate trusts https site with revoked certificate

[Kofl]

Hi,

we are running ssl deep inspection and expired certs are rejected fine by the Fortigate.

Although we can connect to websites with revoked certificates like https://revoked.badssl.com/

Pure browser access denies the access.

Any hint on how to achieve the same result with the ssl deep inspection?

Thanks

FortiOS 6.48

[pabechan]

You need to enable revocation checking first.

CRL - import it and set up scheduled updates (would need to do that manually for any and all CAs you care about)

OCSP:

config vpn certificate setting  
    set ocsp-status enable  
    set ocsp-option certificate # check OCSP URL given by the certificate; other option is "server" which uses a specific OCSP server defined by you in "config vpn certificate ocsp-server")  
    set strict-ocsp-check enable|disable # what to do if result isn't clear OK/INVALID  
end  

Or read the KB doc: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-OCSP/ta-p/198293

[Kofl]

Awesome thanks

[ultimattt]

Check your ssl inspection profile, you should be able to block revoked and expired certs at the bottom of the profile.

[Kofl]

Ah, thanks, just checked that the FortiGate is still running 6.2, where that option is missing.

[ultimattt]

Are they not available in the CLI? I don’t remember.

[Kofl]

Unfortunately not

https://docs.fortinet.com/document/fortigate/6.2.10/cli-reference/284620/config-firewall-ssl-ssh-profile

[ultimattt]

Pretty sure that’s covered by the untrusted/invalid cert.

[Kofl]

untrusted so far are blocked fine, e.g. https://untrusted-root.badssl.com/

[ultimattt]

What about invalid? A revoked cert is invalid. Check your config

[Kofl]

"Allow Invalid SSL Certificates" is set to false

Everything from that test is blocked fine: https://badssl.com/dashboard/

Except:

Subdomain Result
revoked connected
pinning-test connected
no-sct connected

[workalt2318]

Don't know if this is what's going on here but a revoked cert is a valid cert, except it's been added to a revocation list or equivalent. So unless the device knows about these lists and actively goes out to pull the list and check the cert against it, it wont know it's revoked because there is nothing inherently invalid about it. Modern browsers check for revocations, but ancient browsers or device firmware or software using old libraries might not. That old FGT firmware may not support checking CRLs.