Configuring certificate probe failure option

The cert-probe-failure command is not available for FortiGate models with 2 GB RAM or less, including FortiGate/FortiWiFi 40F and 60F series of devices and their variants, and FortiGate-Rugged 60F (2 GB versions only). See Proxy-related features not supported on FortiGate 2 GB RAM models.

With an SSL inspection profile configured for either certificate or deep inspection, the FortiGate performs certificate probing where it checks a server certificate before a client-server HTTPS connection is established. Certificate probe failures can occur due to issues like TCP or TLS handshake failures, misrouted traffic, or untrusted root or intermediate CA certificates. If a certificate is invalid, untrusted, or mismatched, then the FortiGate flags a certificate probe failure in the logs.

Certificate probe failure can be allowed or blocked for HTTPS and SSL:

config firewall ssl-ssh-profile
    edit <name>
        config https
            set cert-probe-failure {allow | block}
        end
        config ssl
            set cert-probe-failure {allow | block}
        end
    next
end

Option	Description
allow	Bypass the session when unable to retrieve server's certificate for inspection.
block	Block the session when unable to retrieve server's certificate for inspection.

For cases that have increased security requirements or stringent organization security policy, certificate probe failure may need to be configured to block. cert-probe-failure is available for custom SSL deep inspection profiles. This option applies to flow mode policies and is available when inspecting all ports is disabled (set inspect-all disable).