Skip to main content
fortibhm
New Member
July 7, 2015
Question

Override HTTPS-Websites (Webfilter override) with Full SSL Inspection

  • July 7, 2015
  • 2 replies
  • 9088 views

Hello,

 

I use the webfilter on my FortiGate 60D (with the newest FortiOS 5.2.3)  to controll the access of websites in var. web categories.

Some web categories should be override with a local user (group) on my Forti. Everything works fine with overriding HTTP-Websites with a local User in this Group (Allow Blocked Override).  But if I click on the "Override-Button" of a blocked HTTPS-Website (for example: 'https://www.twitter.com') it doesn't work --> loop / no override possible.

The "Fortinet_CA_SSLProxy"-certificate is imported in the "Trusted Root Certification Authorities" on all Clients thus the Full SSL Inspection works fine / no certificate warning/error or something. Blocked HTTPS-Websites are blocked and allowed HTTPS-Websites are allowed by opening them in the Client-Webbrowser. 

Override Blocked HTTP-Websites also works. But only the override of HTTPS-Websites doesn't work! Has anyone a solution or a "best practice" for this problem?

 

Greets!

 

 

 

    2 replies

    fortibhm
    fortibhmAuthor
    New Member
    July 14, 2015

    Additionally screenshots for this problem:

     

    1. website of a blocked / override Category - "Alcohol" opened (Certificate Error although the right SSL-Proxy CA already imported)

     

     

     

    fortibhm
    fortibhmAuthor
    New Member
    July 14, 2015

     2. click on "Proceed"-button for override this HTTPs-Website... the Browser hangs up --> loop (FortiGate CA-Proxy-SSL-Certificate is correctly imported into trusted root certification authorities)

     

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!