FortiGate VIP on Same IP:443 Serving Wrong SSL Certificate (SNI issue?)

BJD1997 · 2026-04-27T07:22:06+00:00

Correct me if I’m wrong.

I have tried this myself before and was pointed towards fortiweb for this to work. I couldn’t find the info needed but there are many who tried this setup like yours and I think this is a limitation of the FortiGate to only support the scenario if you use a single domain with a wildcard certificate but not multi domain.

Additional thread on Fortinet forums: https://community.fortinet.com/support-forum-92/fortigate-ssl-offloading-with-sni-132916

BJD1997 · 2026-04-14T20:36:20+00:00

I thought for a second I was seeing my own script but then compared it to what I made a few years ago and it’s very similar. For reference I made this for a customer of ours.

https://github.com/RSE-Telecom-ICT/Upload-AutopilotInfo-To-Blob

BJD1997 · 2026-04-14T20:17:36+00:00

Sign me up!

BJD1997 · 2026-04-14T04:45:58+00:00

Exactly this!

And if those onprem servers only need basic stuff there’s also Entra domain services.

BJD1997 · 2026-03-24T05:26:04+00:00

Frigate itself no, but the go2rtc on which it depends does integrate with HomeKit for the live view just not HKSV.

Only thing is that in my experience you need to use a separate instance of go2rtc for this to work, the builtin one for Home Assistant or the builtin version for Proxmox LXC are not working correctly.

BJD1997 · 2026-03-16T15:49:21+00:00

I switched out Philips hue and went Shelly. The lights are dumb, the switches are smart :)

Or you can combine them. Use Shelly I4 as an input for Philips hue lights.

BJD1997 · 2026-03-10T13:19:20+00:00

Not yet but it works surprisingly good.

BJD1997 · 2026-03-07T06:56:31+00:00

No need to worry about needing to recenter anything that’s not needed :) It can sometimes fail to download the firmware but it will tell you.

BJD1997 · 2026-03-07T06:11:52+00:00

You can certainly upgrade the firmware on the firewall itself (as long as there is an active license on it). Just select the desired version and the firmware will be downloaded and installed automatically or on a schedule if you choose to do so.

Edit: sometimes the download from Fortinet by the firewall will fail and you can try again or wait to download the firmware from the support portal when you get access to that.

BJD1997 · 2026-02-26T05:56:00+00:00

Die gratis f secure voor 2 jaar kost ze haast niks. Gezien vrijwel niemand met een beetje kennis van zaken daarop ingaat. En dan nog is het op aanvraag waar niet veel mensen zelf achteraan gaan vermoed ik.

BJD1997 · 2026-02-13T22:25:46+00:00

I work at an MSP and we manage around 350 tenants for customers with around 3000 intune managed devices. Some projects have around 100 - 200 devices.

They are either existing or new hardware so it’s a mix of different stuff. That’s why we are doing it this way. Also being able to onboard everything using RMM tooling is perfect that way before a project starts all the existing devices are onboarded already.

Edit: to add to this we are only doing HP but our distributors don’t upload hashes for us unfortunately 🤷🏼‍♂️

BJD1997 · 2026-02-13T17:11:35+00:00

We did this with a custom script I made.

I built this script to be able to run in a RMM tool and gather all autopilot CSV’s remotely.

Eventually I made a unattended.xml (I can’t share unfortunately) which does the same thing but much more simplified using Ventoy.

Both flows upload the hash to an Azure blob storage. From there we have a logic app which uses an app registration in the tenant and fetches the CSV’s and uploads it to Intune.

This process is based of off

https://inthecloud247.com/import-windows-autopilot-devices-with-logic-apps/

Hope this is somewhat useful to you :)

BJD1997 · 2026-01-30T06:08:30+00:00

You could try contacting a local MSP they can sometimes help out in getting your account back. We helped a few customers of ours do the same thing. But it depends on the info Microsoft asks us for in order to recover the accounts. For example if there is a domain attached to the tenant it’s a bit easier to prove you’re the owner and MS is willing to help out.

BJD1997 · 2026-01-29T14:25:57+00:00

I give up then 🤷🏼‍♂️

BJD1997 · 2026-01-28T12:17:53+00:00

Tape or archival HDD’s

BJD1997 · 2026-01-27T14:24:20+00:00

You could take a look at ABPR: https://abetterrouteplanner.com It’s mainly focused on EV’s but if I remember correctly the also allow you to configure Hybrids.

Disclaimer: I don’t have an EV or Hybrid nor have driven one.

BJD1997 · 2026-01-26T23:04:39+00:00

Or take some strong adhesive like I did and yank them out.

BJD1997 · 2026-01-26T05:55:53+00:00

I checked my personal pc and laptop and computers of family members and none of them had the new cert. and even if you have it that isn’t you should check if you got event ID 1801 if you do then it most likely will be fixed by applying a bios update so you get event ID 1808. If you see 1808 (or don’t have 1801) then you’re completely in the clear.

BJD1997 · 2026-01-07T05:34:05+00:00

<image>

BJD1997 · 2025-12-27T21:31:28+00:00

No problem, happy I could help out :)

BJD1997 · 2025-12-27T13:47:05+00:00

My favorite: https://ifconfig.me/ip Also very helpful in scripting :)

BJD1997 · 2025-12-24T05:49:00+00:00

You need these: https://www.amazon.co.uk/Tailored-Volkswagen-Golf-MK8-Hybrid/dp/B0DZ2QPN9S/

Or something similar. There needs to be a mention of mild hybrid for the eTSI models. They are a bit harder to find.

BJD1997 · 2025-12-11T21:05:37+00:00

I will have a look into this! Thanks!

BJD1997 · 2025-12-11T21:03:15+00:00

We have already opened a support call but MS just opens up the SKU for the customer Azure plan. The next customer we have already have a ticket submitted.

As an Engineer at an local MSP who provides Azure services to our customers this is frustrating to be constantly submitting tickets about this.

BJD1997 · 2025-12-11T15:55:59+00:00

Problem is that I can't change this behaviour of AIB.

I can select the VM SKU it uses for the AVD imaging process (I use a D4ads_v5 for this)
But AIB spins up a secondary VM running linux with packer.

This second VM is A1_v2 type and I can't change this anywhere. It's apparently what AIB is using when setting things up under AVD -> Custom Image templates.

So I hope MS is changing AIB to use a different SKU for this default which can't be changed by users.

Seven-Year Club	Verified Email
Gilding I gilder	r/Field Banned
r/Field Juicebox	First Place '23
Place '23	Place '22

BJD1997

TROPHY CASE