What's Happening?
Fortinet has identified and provided a solution for an SSL anomaly occurring with malicious certificates from '*.b-cdn.net', which causes FortiGate firewalls to block internet traffic during SSL inspection. Users are unable to load content from certain
internet websites, and FortiGate logs flag the traffic as a certificate anomaly. This issue arises because the TLS certificate associated with '*.b-cdn.net' was added to the FortiGuard Malicious Database (MCDB), leading FortiGate to block the traffic. The problem specifically affects FortiGate devices running MCDB version 1.00609. The certificate has since been removed from the MCDB package in version 1.00610. To resolve this, users need to manually update the MCDB on their FortiGate devices by executing a series of debug commands to reset, update, and enable the application update process.
Why It's Important?
This SSL anomaly significantly impacts network connectivity and user access to legitimate internet content, posing a direct threat to business operations and productivity. When FortiGate blocks traffic due to a perceived malicious certificate, it can disrupt access to critical cloud services, websites, and applications, leading to downtime and financial losses. For organizations relying on FortiGate for robust network security, such false positives undermine the effectiveness of their security infrastructure and can erode user trust. The incident highlights the critical role of up-to-date threat intelligence databases, like the MCDB, in maintaining a secure yet functional network environment. Delays in updating these databases or issues with their content can have immediate and widespread consequences, necessitating prompt action from both the vendor and the end-users to restore normal operations and ensure continuous, secure access to online resources.
What's Next?
FortiGate users experiencing this SSL anomaly are advised to immediately perform a manual update of their Malicious Certificate Database (MCDB) to version 1.00610 or newer. This involves executing specific debug commands on the FortiGate device: `diagnose debug reset`, `diagnose debug application update -1`, `diagnose debug enable`, `execute update-now`, and `diagnose autoupdate versions`. After the update, users should disable the debug processes using `diagnose debug disable` and `diagnose debug reset`. This manual intervention is crucial to ensure that the FortiGate no longer incorrectly blocks traffic associated with '*.b-cdn.net'. Organizations should also review their automated update schedules for FortiGuard services to prevent similar issues in the future and ensure their threat intelligence is always current. Continuous monitoring of Fortinet's security advisories and community forums is recommended for timely awareness of such critical updates.
Beyond the Headlines
This incident underscores the delicate balance between aggressive threat detection and preventing false positives in cybersecurity. While adding certificates to a malicious database is a proactive measure to protect against threats, an erroneous or outdated entry can inadvertently disrupt legitimate traffic, causing operational headaches. It highlights the continuous challenge faced by cybersecurity vendors in maintaining highly accurate and rapidly updated threat intelligence. The reliance on manual updates in such critical situations also points to potential gaps in automated security management, emphasizing the need for robust, self-correcting systems. Furthermore, the event serves as a reminder for organizations to have clear protocols for responding to network disruptions caused by security systems, including procedures for verifying the nature of the block and applying vendor-provided fixes promptly. This proactive approach to incident response is vital for minimizing the impact of such anomalies on business continuity and user experience.
