Own certificate for web filter in FortiClient possible?

Forum|Forum|5 years ago
October 30, 2020
9 replies
8892 views

I have a test setup with EMS 6.2.6 and FortiClient 6.0.10. When enabling the web filter in the config, I get a certificate warning on the client pc because of the untrusted certificate used by FortiClient. It's a self signed certificate of the FortiClient itself.

Is it possible to select/configure a different certificate (we have an internal pki) for web filter use?

I found a few similar topics but they all where about the web filtering using FortiGate. However this is a FortiClient/EMS only setup.

Kenundrum

New Member

Yes you can do this. In the EMS, go to the policy components menu and the CA Certificates section. You can upload a CA Cert that is trusted by the clients. The type of certificate is exactly the same as the one you would create for use with FortiGate SSL inspection- typically a Sub-CA of your internal trusted CA.

In each profile, the system settings tab "Other" section is where you would choose which CA certificate would be sent to the client and used for local web filtering.

MagionAuthor

New Member

Oooh, is that what CA certificates is for?? Duh! Totally missed that.

Gonna try it out right now!

MagionAuthor

New Member

Hmm... nope... not working. The certificate shown in the browser is still the self signed certificate.

ryan_www

Explorer III

I ran across this post after experiencing a similar issue on FortiClient 7.2.3 on MacOS. There is a known bug at the moment for FortiClient 7.2.3 on MacOS where the locally generated web certificate is created, but can't be set to trusted if installed while a non-admin user is logged in. Support confirmed that it is not possible to use a centrally managed certificate. Hopefully they can add an option like this as it seems like it could be more reliable to use a centrally managed certificate pushed by MDM. Seems dangerous to hope that the OS does not un-trust the locally generated certificate.

gunthest

New Member

This is the exact issue I am having. Support told me this is part of their new web filtering system, not that it was a bug. This is disastrous. Hopefully they get it together and address this.

Ragman

New Member

We have also run into this bug using FortiClient 7.2.3. Has there been any movement from Fortinet regarding this issue.

ryan_www

Explorer III

Last month, support told me it was being actively investigated as a bug and there was no workaround. I think it is bug 950099 in these release notes. https://docs.fortinet.com/document/forticlient/7.2.3/macos-release-notes/124818/known-issues

Sign up

Login with SSO

Login to the community

Login with SSO