Using CF as pass through to Fortiweb with wildcard cert on web server

Website, Application, Performance DNS & Network
1

What is the name of the domain?

https://bahrain-select-6-staging.jfd.dev/

What is the error number?

SEC_ERROR_UNKNOWN_ISSUER

What is the error message?

SEC_ERROR_UNKNOWN_ISSUER

What is the issue you’re encountering

CF is set for just DNS (no proxy) and has a CNAME pointing to the Fortiweb record but we’re still getting SSL errors

What steps have you taken to resolve the issue?

Wildcard cert is installed on both Fortiweb and Web Server.
CF is set to not proxy (DNS only)
SSL Encryption Mode on the primary domain (jfd.dev) is set to Custom > Full

If you set hosts file to bypass CF and hit the FW the site is visible so issue feels like it lies in CF

What feature, service or problem is this related to?

I don’t know

What are the steps to reproduce the issue?

Visit https://bahrain-select-6-staging.jfd.dev/

2

As you are set to “DNS only”, it’s not a Cloudflare issue as requests are going direct to your origin. You will need to check why SSL is not working on your origin.

3

Does this have any effect if it’s a wildcard cert? I understand this might be further down the request but if we’re using a wildcard cert (on a sub-domain) are there any other considerations?

4

Having a certificate issued does nothing if it’s not served during the request.

And if the requst for a specific hostname isn’t going through Cloudflare Proxy, Cloudflare can’t serve any SSL certificate for that hostname in question.

So, no, having a Cloudflare wildcard cert issued for *.example.com can’t affect foo.example.com that’s DNS Only (:grey:). Likewise, Cloudflare can’t play any role when serving your own wildcard on your origin server for an unproxied hostname.

By the way, the URL you provided works for me now, with a Sectigo certificate.

5

Looks like perhaps it just needed time. I did switch this to Automatic SSL (rather than Custom) but seems to have resolved after a couple of hours.

Is that normal?

6

As mentioned above, the DNS record for bahrain-select-6-staging.jfd.dev is not proxied so requests are not passing through Cloudflare therefore your Cloudflare settings don’t do anything for that subdomain. Your apex, www and wildcard records are proxied though so requests to those do pass through Cloudflare and any changes you make affect those…
https://cf.sjr.dev/tools/check?0e5512f9a00a4edf8f3fd8dbecb4b625#dns

7

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.