1

I run a web site and email server for purely personal purposes on a VPS. I created a self-signed cert for the server and installed the relevant CA cert as a profile on my iPhone as well as on desktop Firefox. This has worked fine for a long time.

Just now, connected to no event I can identify, the iPhone claims the server cert is not trusted. Upon inspecting the cert on the phone, I see that it has been issued by Fortinet rather than my self-created CA. The DNS entries are the same as are the validity dates. The key length is different (mine: 3072, theirs: 2048).

As of now, Firefox on the desktop is still working as before. The cert files on the server have not changed.

This has me a bit nervous. Can anyone shed light on what might be going on here?

Improve this question
6
  • 2
    Are you using Fortinet's (or Fortigate's) security products? If so, it may be doing deep packet inspection. To do this on an SSL connection, it must MITM the connection, meaning that it must replace the server's certificate with its own (and your browser must trust their certificate). See inside.fortinet.com/doku.php?id=fortigate:about_ssl_inspection for more info.
    – mti2935
    Jun 25, 2021 at 18:51
  • I'm not (at least not intentionally - what Apple might be doing is another matter). I wonder if this isn't some "feature" being offered by either my domain registrar (namecheap) or VPS provider (digitalocean). If so, I'd really like to opt out.
    – Steve
    Jun 25, 2021 at 19:40
  • The VPS might have installed a load balancer or a CDN. This is really a question for your VPS support.
    – schroeder ♦
    Jun 25, 2021 at 20:19
  • 3
    I don't think the problem is at (or near) the VPS or the VPS provider. If it was, then Firefox would show the Fortinet certificate, but you say that Firefox is working as it did before (I assume this means that Firefox is showing your self-signed cert for your site). If your phone is the only device that is showing the Fortinet certificate for your site, then I would focus on the phone. Are you sure you haven't installed any kind of security app on the phone recently? Does the behavior the same regardless of the wifi and/or mobile connection that you connect the phone to?
    – mti2935
    Jun 25, 2021 at 20:43
  • Excellent call @mti2935, thank you! The issue was occurring at my workplace. Upon returning home, everything was fine. My tentative hypothesis is that the IT people at work had enabled a Fortinet MitM "solution" on wifi (but not hardwired ethernet strangely enough). As of today, it's no longer happening though. Waiting to see if this is a portent of things to come...
    – Steve
    Jun 28, 2021 at 14:20

1 Answer 1

Reset to default
0

After a bit of back and forth with the OP in the comments following the question, it turns out that the OP was only experiencing this problem on his iPhone when his iPhone was connected his workplace's network (presumably by WiFi).

The most likely explanation for this was that his workplace may have implemented Fortinet's security product at the perimeter of its network, to protect all of the devices on its network. To do this, the security product must do 'deep packet inspection' to inspect traffic in and out of the network for viruses, malware, etc. To do this, the security product must essentially MITM all SSL/TLS connections. To do this, Fortinet's CA certificate must be installed on all devices on the network.

While the workplace may be able to install Fortinet's certificate on company owned devices, they most likely are not be able to do so on employee-owned devices (like OP's iPhone). The fact that Fortinet's certificate was not installed on OP's iPhone is probably the most plausible explanation for the certificate error that OP was getting when he tried to reach his own site from his iPhone while connected to his company network. If that's the case, then others connecting personal devices to the same network probably experienced similar problems. Realizing the problems caused by what they were doing, it seems that the workplace may have disabled the security product (at least for part of the network where employee's can connect their own devices).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .