HTTPS Filtering with Subject Alternative Names SAN

Forum|Forum|6 years ago
May 8, 2020
1 reply
5765 views

Hello Community,

I am struggling to find any information on my problem. Are Fortigate Firewalls in any OS able to evaluate the Subject Alternative Name (SAN) information in a certificate?

To give a specific example: We want to monitor access to https://pastebin.com

Since the connection is TLS encrypted we have to rely on certifictae inspection (deep inspection is not an option). I know, the certificate inspection is evaluating the CN field in the presented certificate. Unfortunately, since the website is announced via Cloudflare, the CN for the website is issued for Cloudflare. Just the SAN field of the certificate states pastebin.com as valid alternative name.

At the moment I do not see any possibility to filter or monitor this. Anyone faced a similar situation and has some advice?

Kind regards,

Daniel

DanielWAuthor

New Member

Well, got an official answer:

"Unfortunately the behavior of webfilter is maintained throughout all the FortiOS versions, which means that the webfilter, when using certificate inspection, will look at the CN of the certificate presented by the webpage."

Therefore, my example would pass the webfilter if you do not block Cloudflare in general.

tanr

New Member

I'm surprised they haven't put in code to look at the SAN in certificate inspection, and that the web filter isn't yet capable of looking at the SAN. Seems like a that should be a core part of both of these, given current SAN usage.

Have you raised this as a New Feature Request (NFR) with your Fortinet SE?

emnoc

New Member

I'm sure that is not true in that response. If a Subject AltName is present the CN is overlooked from my experience, you can test that out in a browser and then thru the fortios with web-profile. No modern browser uses the CN btw and when the AltName is present

Ken Felix

Sign up

Login with SSO

Login to the community

Login with SSO