Technical Tip: FortiGate is not including AKID when resigning certificates during deep inspection

When FortiGate is performing SSL deep inspection on both flow mode and proxy mode, the resigned server certificate sent by FortiGate to the end user is missing the Certification Authority Key ID (AKID).
As a result, the end user is receiving a certificate warning.

When opening the certificate, the Certification Authority Key ID is not observed:

As per RFC5280 section 4.2.1.1:

The keyIdentifier field of the authorityKeyIdentifier extension must be included in all certificates generated by conforming CAs to facilitate certification path construction.

This issue has been fixed in the following FortiOS versions:

1. When firewall policy is in proxy mode or when an explicit web proxy is being used, the issue 983997 has been fixed in FortiOS versions 7.2.11 and 7.4.8.
2. When the firewall policy is in flow mode, issue 1181573 has been resolved in FortiOS versions 7.4.10 and 7.6.5.

Important Note: The CA certificate used for deep inspection MUST contain Subject Key Identifier; otherwise, the Authority Key Identifier will not be included on the modified server certificate presented to the client.

Related documents:

• Resolved Issues 7.4.10
• Resolved Issues 7.6.5