Explicit transparent proxy with Kerberos Auth

Hello there,

I'm trying to configure Explicit Proxy on my Fortigate 500E with FortiOS 6.0.5 and no luck so far.

My Fortigate is linked to my fortianalyzer and I just want to log every http/https traffic without any deep inspection SSL.

I followed multiple tutorials that we can found online and everything is pretty working well when we are using a PAC file (and add it to our web browsers configuration).

However, I want to make my last step and make it works transparently.

It seems to work well with HTTP website. When I call it, my kerberos ticket is created on my workstation and when I go on my firewall user monitor I can see my user logged with attribute Explicit + Firewall.

But if I browse an HTTPS website, I always have a certificate SSL error (and I don't want to import my fortigate SSL certificat into all my workstations).

I don't understand why it works well when proxy information is added to the web browser and with the same "filtering option" in transparent, it works with http site but not HTTPS.

Any tips for me ?

here my configuration:

config authentication setting
    set active-auth-scheme "Kerberos"
    set captive-portal "WEBPROXY_PORTAL"
    set captive-portal-port 9666
end

config authentication scheme
    edit "Kerberos"
        set method negotiate
        set kerberos-keytab "http_service"
    next
end

config authentication rule
    edit "WINRDM_Kerberos"
        set srcaddr "HOST_WINRDM"
        set ip-based disable
        set active-auth-method "Kerberos"
        set web-auth-cookie enable
    next
end

config firewall profile-protocol-options
    edit "RDM_PROXY"
        set oversize-log enable
        config http
            set ports 80 8080
            unset options
            set http-policy enable
            unset post-lang
        end
        config ftp
            set ports 21
            unset options
        end
        config imap
            set ports 143
            set options fragmail
        end
        config mapi
            set ports 135
            set options fragmail
        end
        config pop3
            set ports 110
            set options fragmail
        end
        config smtp
            set ports 25
            set options fragmail
        end
        config nntp
            set ports 119
            unset options
        end
        config dns
            set ports 53
        end
    next
end

config firewall proxy-policy
    edit 1
        set uuid 7df5374e-021e-51ea-e207-43c246918c92
        set proxy transparent-web
        set srcintf "internal"
        set dstintf "port1"
        set srcaddr "HOST_WINRDM"
        set dstaddr "all"
        set service "webproxy"
        set action accept
        set schedule "always"
        set logtraffic all
        set groups "RDM_WEB_FILTERING"
        set utm-status enable
        set webfilter-profile "RDM_LOG_ALL"
        set profile-protocol-options "RDM_PROXY"
        set ssl-ssh-profile "certificate-inspection"
    next
end

config user ldap
    edit "LDAP_RDM_AD_CN_1"
        set server "172.28.26.50"
        set cnid "cn"
        set dn "DC=test,DC=local"
        set type regular
        set username "CN=SVC_ldap,OU=Service Accounts,OU=TEST,DC=test,DC=local"
        set password ENC *****
        set secure ldaps
        set port 636
    next
end

config user krb-keytab
    edit "http_service"
        set principal "HTTP/rdm.test.local@TEST.LOCAL"
        set ldap-server "LDAP_RDM_AD_CN_1"
        set keytab "******"
    next
end

config user group
    edit "RDM_WEB_FILTERING"
        set member "LDAP_RDM_AD_CN_1"
    next
end

Thanks!