Generate True Self-signed Certificate for SSL Inspection on Fortigate

Thought I would mention something as we are fighting this right now.  Be very careful about using the latest docs when using openssl to self-sign a cert.  For instance this command:

 

openssl genrsa –des3 –out fgssl.key 2048   would generate a key using 3DES which is no longer suggested due to it being easier to compromise than it should be.  The current 6.0 documentation (https://docs.fortinet.com/d/fortigate-pdf-handbook-60) suggests:   openssl genrsa -aes256 -out fgtcapriv.key 2048   This creates the AES 256bit private key.  Then you need to generate the cert:   openssl req -new -x509 -days 3650 -extensions v3_ca -key fgtcapriv.key -out fgtca.crt   This creates a v3 CA Cert that is valid for 10 years from the date of creation.  As this cert is marked as a CA, it can be used for SSL/TLS DPI on a Fortigate, as long as you make sure this cert is installed as a Trusted Root CA in every machine/phone that will be attempting to run traffic through that policy.  In Windows you can do this by pushing it out via a group policy.   You cannot buy a CA cert for DPI on a Fortigate.  You need to use the built in one or sign one (self-sign) yourself.   But there is another issue.  When you issue this command, openssl will complain that you need an openssl.cnf file.  Creating this is not for the faint of heart.  This page has lots of good information on doing so:  

https://www.phildev.net/ssl/opensslconf.html

 

Here's the FortiCookbook pages, but they neglect to discuss the openssl.cnf issue.

http://cookbook.fortinet.com/preventing-certificate-warnings/

 

We are trying to generated a private key that uses ECDHE256.  We keep ending up with ECDSA256 which isn't what we want.  I'll post all the steps when I figure it out.

 

The main idea about signing your own cert is security.  Only you will have the private key and it will never have been anywhere else.  I'm not sure if the Fortinet built in SSLProxy certs are unique to each FG, but to be sure you sign your own and you back it up.  Then when you update your Fortigate you can reload it if anything goes wrong.  That saves you the hassle of having to push a new one out. 

 

That is our current predicament.  We created a v1 CA cert somehow, so now we need to create one that is v3 and redeploy that to all our devices before we move to 5.6 or 6.  Not fun.

 

If you want to learn about OpenSSL and how it relates to TLS and cert management this is a great resource:

 

https://www.feistyduck.com/books/openssl-cookbook/