Skip to main content
cpattonsfs
cpattonsfs
New Member
May 10, 2017
Question

Fortigate SSL certificate used - NOT using DPI

  • May 10, 2017
  • 1 reply
  • 11114 views

I am using Certificate Inspection, but I an not using Deep Packet Inspection. I visited a website today and got a certificate error, and upon inspection saw that it was the Fortigate certificate.

 

Why did this occur? It doesn't occur on the vast majority of sites; and when I bypass the filter, I can see that the certificate chain is valid with no problems. So why did the Fortigate substitute its own certificate?

1 reply

hmtay_FTNT
Staff
hmtay_FTNT
Staff
May 10, 2017

Hello Charlie, 

 

Do you have a Web Filter or Application Control sensor with entries set to Blocked? If you do and you enabled the setting to send a replacement-message indicating that a page is blocked, the Fortigate will do a MitM to send you the replacement-message page if the session is a HTTPS session.

cpattonsfs
cpattonsfsAuthor
New Member
May 10, 2017

I don't have replacement messages for sites blocked by web filter, but under Security Profiles > Application Control I do have "Replacement Messages for HTTP-based Applications" turned on (apparently. I didn't realize I had enabled this). However, I turned it off, and the issue still occurs.

 

Is there a way I can find out if this is triggering some policy that I just haven't tracked down? Maybe through the logs?

hmtay_FTNT
Staff
hmtay_FTNT
Staff
May 10, 2017

What is the page you are trying to access? You can check in the logs to see which module is triggering on the session and what's the action. Check for the log entries with action Block. I believe it's likely to be one of them.

Terms & ConditionsAccessibility statement