Skip to main content
jheadley_FTNT
Staff
jheadley_FTNT
Staff
February 28, 2017

Technical Tip: SSL inspection on multiple FortiGates using the same certificate (OpenSSL method)

  • February 28, 2017
  • 0 replies
  • 14517 views

Description

 
To avoid certificate warnings when performing SSL Inspection, the CA certificate in the SSL Inspection profile must be imported into the users’ web browser.
Commonly, it is desired for multiple FortiGates to utilize the same certificate in their SSL Inspection profiles, so network administrators don’t have to manage and import multiple certificates into their users’ web browsers.
This article explains an efficient way to do this using OpenSSL.


Scope

Fortinet devices running FortiOS 5.0 and above.


Solution

 

Method 1: FortiGates perform SSL inspection as an intermediate CA with a certificate issued by a company's private root CA (Preferred Method),
  1. Download and install OpenSSL for the operating system.

  2. Generate a RSA private key using OpenSSL.

 

openssl.exe genrsa -out private.key 2048

 

Note: the private key file generated above should be kept secure. Anyone who obtains this private key can impersonate the FortiGate.

 

  1. Generate a certificate signing request (CSR) using this private key.
 
openssl.exe req -out mycsr.csr -key private.key -new -sha256
 
  1. Submit this CSR to be signed by the private certificate authority (CA) of choice.

    It is required that when the private CA signs this CSR, the new certificate is made an intermediate CA of the private CA.
    If this has been done correctly, viewing the certificate details will show X509v3 Key Usage: Certificate Sign and X509v3 Basic Constraints: CA:TRUE.
    Commonly, network administrators will utilize FortiAuthenticator or Active Directory Certificate Services on the Windows Domain Controller to sign this CSR.
    A public CA (GoDaddy, VeriSign, etc) will never issue an intermediate CA certificate that can be used for SSL inspection. They are contractually prohibited.

  1. Import both the certificate from Step 4 and the private key from Step 2 into all desired FortiGates by navigating to the Certificates section in the web GUI and selecting Import -> Local Certificate -> Type: Certificate.

  2. In your SSL Inspection profile(s), select the newly imported certificate as the CA certificate for the profile.
Method 2: FortiGates perform SSL inspection as a private root CA.
  1. Download and install OpenSSL for the operating system.

  2. Generate a RSA private key using OpenSSL.

 

openssl.exe genrsa -out private.key 2048

Note: The private key file generated above should be kept secure. Anyone who obtains this private key can impersonate the FortiGate.

 

  1. Generate a root CA certificate using this private key.
 
openssl.exe req -x509 -new -nodes -key private.key -sha256 -days 1825 -extensions v3_ca -out mycertificate.crt
  1. Import both the certificate from Step 3 and the private key from Step 2 into all desired FortiGates by navigating to the Certificates section in the web GUI and selecting Import -> Local Certificate -> Type: Certificate.

  2. In the SSL Inspection profile(s), select the newly imported certificate as the CA certificate for the profile.
 

Note that OpenSSL is a third party tool and while helpful, it is not supported by Fortinet.

Related articles:

Terms & ConditionsAccessibility statement