Skip to main content
jeinnor40
jeinnor40
New Member
September 23, 2019
Question

"CA:TRUE" certificate for deep inspection where to buy

  • September 23, 2019
  • 1 reply
  • 8160 views

Hi

 

I am being sent round and round and not sure what is correct.

 

I am looking to purchase what Fortinet refers to as a "CA:TRUE" certificate. I want to put it into deep inspection so that I do not have to apply the self-assigned to all devices. My supplier said a person cant get one of these but when I contacted one of the vendors they sent me a quote. So I am confused as to what is true, whether you can or cannot get one and if so who the best supplier is of these kinds of certificates?

 

Ron

    1 reply

    neonbit
    neonbit
    New Member
    September 23, 2019

    You can't buy one of these certs from the traditional CA's (like Verisign, GoDaddy etc). They don't want you signing websites like Gmail on their behalf.

     

    You generally need to have your own company CA and issue a cert from that (and import the CA cert into your clients).

     

    OpenSSL is a free tool that lets you create a CA certificate and then sign the FGT one with CA=True.\

     

    There's a cookbook article on what you need to do on OpenSSL to sign the FGT cert:

    https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/228718/creating-a-certificate-with-openssl

    jeinnor40
    jeinnor40Author
    New Member
    September 24, 2019

    Thank you for this, will give it a whirl ;)

    ergotherego
    ergotherego
    New Member
    December 20, 2019

    I was finally able to solve this as well, by using an actual CA certificate authorized for re-signing. We use FortiAuth internally, and I had to upgrade from 5.4.1 to 6.0.3 so that I could create an intermediate certificate -AND- be able to export the key for that new cert. Previous versions of FAC don't allow that.

     

    Then you add that CA cert as a Local cert normally to the FortiGate. Reference it in your SSL Inspection rules. And ensure your hosts/end-points trust the cert of your CA - in my case, the root CA of the FAC itself.

    Terms & ConditionsAccessibility statement