Skip to main content
Zac67
Zac67
New Member
August 4, 2017
Solved

Certificate inspection: untrusted certificate warning broken (5.4.5)

  • August 4, 2017
  • 3 replies
  • 67044 views

When you've activated certificate inspection or deep SSL inspection, the acceptance of the external certificate is up to the FG. When it rejects the external certificate it the page with the warning:

"This Connection is Untrusted ..."

 

You can check this e.g. on https://self-signed.badssl.com/

 

However, for this page's certificate the FG always uses a certificate signed by the factory "Fortinet Untrusted CA", regardless of what you've set up for HTTPS or SSL inspection.

 

According to support (ticket #2289811), this is not configurable. In my humble opinion, this function is broken since it urges the user to (permanently) accept a root certificate which is present - and extractable - on every Fortigate on the planet, leaving a critical vulnerability for man-in-the-middle attacks.

 

Are there any ways around this? Is this issue addressed in 5.6?

Best answer by FAPM

Hi,

I am in version 5.6.2 and I have the same problem ... 

3 replies

bommi
bommi
New Member
August 4, 2017

Hi,

 

I just checked this, but I cant change the Untrusted CA Certificate in 5.6.1.

 

Regards

bommi

Zac67
Zac67Author
New Member
August 4, 2017

Pity - thanks for the feedback!

dmcquade
dmcquade
New Member
August 9, 2017

The problem is you are using the default CA cert on the Fortigate. You could download this and add to your workstations as a trusted CA cert. Although named the same, it is NOT the same cert on all Fortigates.

 

I've implemented this by generating a CSR on the Fortigate and submitted it to the local network PKI to create a CA Cert using an ICA already trusted by the workstations. Import this into the Fortigate and the workstations will not receive the Untrusted Cert message.

rdumitrescu
rdumitrescu
New Member
August 10, 2017

Hi Zac67,

By default the firewall use an "Untrust CA" for the websites that have broken certificate. (as your example "https://self-signed.badssl.com/")

You can change that from CLI:

config firewall ssl-ssh-profile edit "--your profile--" set untrusted-caname "your trusted CA" end

 

In this way you will avoid the certificate warning. (If you have installed on the PC the "trusted CA")

Still, the best practice says to warning the users when they are going to an "untrust" (faulty certficate) website.

So you should find your best compromise between usability and security.

 

Regards Radu

Zac67
Zac67Author
New Member
August 29, 2017

Thanks for your suggestion, Radu! "Untrusted-caname" was the keyword, now I can also find at least a cursory mention in the manual under Inspection Exemption(!) - support wasn't able to point me there.

 

Setting untrusted-caname to the (working) SSL-inspection-certificate didn't work. Now the warning page can't load any more at all (keeps connecting forever). Even an unset untrusted-caname doesn't fix this. But it's definitely the right track: Certificates in the GUI counts one reference less to the Fortinet untrusted CA cert and one more for ours. I'll investigate further.

FAPM
FAPMAnswer
New Member
August 29, 2017

Hi,

I am in version 5.6.2 and I have the same problem ... 

Terms & ConditionsAccessibility statement