Fortigate deep inspection certificate

Forum|Forum|10 months ago
October 29, 2025
2 replies
740 views

Hi everyone!

I do have HQ, and 10 more branches. Each branch has direct internet. So I need to do a deep inspection at each site. I was using the normal way. Generate a CSR from each Firewall. Sign it by my Local CA as a subordinate. Then import it to my FortiGate. Then use this new cert in my SSL policy.

But I have read a document from Fortinet showing a better way to create on my Local CA:

Create a Microsoft sub CA certificate

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/680736/microsoft-ca-deep-packet-inspection

Still, I'm confused. What's the different, and better way? Just generate one cert as mentioned. Or do CSR from each FW to let FW information appear to users when there is an SSL error?

Kindly advise and let me know the best and different.

Note. I do have Local CA and FortiManager to manage all my 10 FortiGates.

FortiGate

AEK

SuperUser

Hi Saleem

I guess the main advantage of creating the sub CA from your CA is to do it quicker and simpler, since you can generate it once and import it on all FGTs.

While the advantage of the fist method is that the private keys remain in FortiGates and there is no risk someone can get it.

AEK

Cajuntank

Contributor III

That is how I did mine. Using one sub CA certificate created and importing it to all of my FortiGates. It used to be where all you needed on the device was the root CA since the trust for the sub CA was already there, but with more modern browsers, you will need both root and sub CA certificates deployed to the devices as to not cause problems.

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/680736/microsoft-ca-deep-packet-inspection

Create a Microsoft sub CA certificate

Sign up

Login with SSO

Login to the community

Login with SSO