Skip to main content
hoyty
hoyty
New Member
November 7, 2016
Solved

Creating a certificate with keyusage=certsign or Subordinate Certification Authority?

  • November 7, 2016
  • 1 reply
  • 9166 views

I was pointed to http://docs.fortinet.com/uploaded/files/2041/using-a-custom-certificate-for-SSL-inspection.pdf by support when I asked about using cert for ssl inspection. Are these instructions only meant for someone who has an internal CA that is trusted by clients? It seems that no Public SSL CA company would grant this type of cert. If that is the case the directions don't really say that. I am just trying to do web filtering of my clients and was hoping to not have to install cert on them.

 

Also how does it work with web filtering on guest network / byod where you can't install cert on client machines?

Best answer by oheigl

Short answer to your question: Yes. The reason why you need an internal CA is because otherwise the whole certificate system used in the web wouldn't be worth anything. If there would be a public CA which is trusted by default within the OS and issues certificates for every website to every person there would be no reason to verify a certificate, because everybody could get one for every website. That's why a public CA verifies if you are really the owner of the domain you are requesting a certificate from.

If you don't want to install a certificate on all your clients you could use certificate inspection - this option doesn't decrypt the SSL connection, it only checks for the CN in the provided certificate from the web server. Also if you have a windows environment it's not that big of a deal to setup a CA certificate and roll it out to all clients via group policies. 

 

Regarding BYOD: That's always a big issue, some companies don't enable the SSL decryption, others are forwarding to a website via the disclaimer to download the CA certificate before browsing and with manuals to install the CA certificate, it's really your own decision what you want to accomplish and what your security needs are.

 

Hope that helps!

1 reply

oheigl
oheiglAnswer
New Member
November 8, 2016

Short answer to your question: Yes. The reason why you need an internal CA is because otherwise the whole certificate system used in the web wouldn't be worth anything. If there would be a public CA which is trusted by default within the OS and issues certificates for every website to every person there would be no reason to verify a certificate, because everybody could get one for every website. That's why a public CA verifies if you are really the owner of the domain you are requesting a certificate from.

If you don't want to install a certificate on all your clients you could use certificate inspection - this option doesn't decrypt the SSL connection, it only checks for the CN in the provided certificate from the web server. Also if you have a windows environment it's not that big of a deal to setup a CA certificate and roll it out to all clients via group policies. 

 

Regarding BYOD: That's always a big issue, some companies don't enable the SSL decryption, others are forwarding to a website via the disclaimer to download the CA certificate before browsing and with manuals to install the CA certificate, it's really your own decision what you want to accomplish and what your security needs are.

 

Hope that helps!

hoyty
hoytyAuthor
New Member
November 8, 2016

Thanks for the confirmation of my fears. I am probably happy with cert inspection for bad sites. The problem I have is if a user goes to a https site and it is blocked by web filtering agent based on URL / IP the client is presented the Fortinet cert and the user gets warning / error depending on browser. Can I used my purchased cert in that scenario when the users gets redirected to "blocked" page?

Terms & ConditionsAccessibility statement