Problems with SSL inspection and Web filter

Hello,

When page is blocked and replacement message is shown to client, this is still HTTPS page. And by default, FortiGate is using certificate that is signed by untrusted CA. So if you have your own certificate signed by trusted CA, you can change this:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Encrypting-replacement-messages-with-a-custom/ta-p/198693

Other option is to disable HTTPS replacement message, but this will cause that only blank page will be displayed if page is blocked. And that can be confusing for client.

Adrian

Dear Customer,

The problem occurs when a user tries to access a website via Google Chrome and encounters the error NET: ERR_CERT_AUTHORITY_INVALID. This error indicates that Chrome detects the SSL certificate is not issued by a trusted Certificate Authority.

Initial Checks:

• Make sure SSL Inspection is enabled on the FortiGate Firewall by navigating to Policy & Objects -> Firewall Policy -> Edit Policy -> SSL/SSH Inspection.
• Verify if a Web Filter is applied in the same policy.

Check DNS Settings:

Go to the affected PC and identify the DNS settings. Note down the DNS server IP and ensure it is being used across the LAN network.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Resolving-NET-ERR-CERT-AUTHORITY-INVALID/ta-p/278490

Thanks 

Pavan

Hello, did you installed Fortinet_CA_SSL (downloaded on the deep-inspection profile) on thoses clients?
Just to be clear, install the certificate into the trusted root certificate authorities store.

I think the inspection certificate and the block https page certificate are the same.

Leandro.

Hi @jcvm,

It look like that the web is blocked and it tried to redirect to blocked replacement message. Make sure you installed the Fortinet_CA_SSL cert on local computer.