Configuring certificate probe failure option

With an SSL inspection profile configured for either certificate or deep inspection, the FortiGate performs certificate probing where it checks a server certificate before a client-server HTTPS connection is established. Certificate probe failures can occur due to issues like TCP or TLS handshake failures, misrouted traffic, or untrusted root or intermediate CA certificates. If a certificate is invalid, untrusted, or mismatched, then the FortiGate flags a certificate probe failure in the logs.

Certificate probe failure can be allowed or blocked for HTTPS and SSL:

config firewall ssl-ssh-profile
    edit <name>
        config https
            set cert-probe-failure {allow | block}
        end
        config ssl
            set cert-probe-failure {allow | block}
        end
    next
end

Option	Description
allow	Bypass the session when unable to retrieve server's certificate for inspection.
block	Block the session when unable to retrieve server's certificate for inspection.

For some cases, certificate probe failure may need to be configured to allow to avoid issues with some network or server deployments that do not support certificate probing. cert-probe-failure is available for custom SSL deep inspection profiles. This option applies to flow mode policies and is available when inspecting all ports is disabled (set inspect-all disable).