Can I use CA Certificate (e.g., DigiCert, GlobalSign, etc.) for Deep Inspection?

Forum|Forum|6 years ago
July 26, 2020
5 replies
5405 views

Hello,

instead of using the Self-Signed Fortinet Certificate on FortiGate v6.2.1

Anybody used CSR to buy a Certificate from a well known CA, and installed it on the FortiGate v6.2.1 to be installed on the end users for DEEP INSPECTION ?

Thanks n advance ...

James_G

New Member

You cannot do this, the cert for deep inspection needs to be a root cert, no 3rd party is going to give you a root cert.

sw2090

SuperUser

it can also be a sub CA. This alas will require the clients to have the certificate chain installed in order to verfiy the certificate and trust it.

Works fine here with sub ca from our internal ca with all clients having the ca certificate from our ca installed.

sw2090

SuperUser

This is because if you want to do deep inspection you have to be man-in-the-middle. So you need to decrypt the original incoming connection but also hand it on to the client requesting it encrypted.

For this you need to be able to sign certificates and that requires a root or sub ca.

Sign up

Login with SSO

Login to the community

Login with SSO