Question about FortiGate TLS 1.3 PQC support and potential WebFilter bypass

Hello,

I stumbled upon article that stated that you can bypass webfilter if website is using TLS 1.3 PQC but even when I tried to do it my FortiGate dropped traffic as it should. FortiGate is running 7.4.12 FortiOS.

Article is from Fortinet staff: https://community.fortinet.com/fortigate-3/technical-tip-how-to-block-tls-1-3-pqc-when-using-deep-inspection-is-not-enable-and-web-filter-is-bypassed-using-flow-based-policy-ssl-certificate-inspection-190103

so I'm not really sure if I did something wrong or is this article just… wrong. I tested using local URL webfilter, no DPI (certificate inspection only), App control allowing all apps, policy set in flow mode, DNS local (no DoH or DoT). Website I used: developers.cloudflare.com

I would be glad if someone would test if bypass is possible (which means I would have to block TLS 1.3 PQC for security reasons).

As always, thanks in advance.

EDIT: I didn't notice that I disabled ECH – encrypted hello. With allowed ECH + TLS 1.3 PQC I confirm that bypassing webfilter is possible. By default even on built-in certificate inspection ECH is blocked. Misconfiguration can still happen tho.