Skip to main content
mbence84
mbence84
New Member
September 22, 2020
Question

Public Signed SSL certificate for SSL deep inspection

  • September 22, 2020
  • 2 replies
  • 23309 views

Can this be done, public Signed SSL certificate for SSL deep inspection on foritgate . Is this possible so that there is no import needed on client devices.

    2 replies

    andrewbailey
    andrewbailey
    New Member
    September 22, 2020

    Hi mbecne84,

     

    Yes, you can use your own certificate- but it needs to be a CA (Certificate Authority) certificate (ie one that is capable of signing another certificate). The CA certificate is used to resign the certificates end users see.

     

    Generally CA signing certificates are pretty expensive and require deeper validation. I guess that's why Fortinet provide a signing certificate for each Fortigate.

     

    If you have a look at the Fortinet_CA_SSL cert details you will see it has "CA:TRUE". That's what you need for your own certificate.

     

    If you are concerned about cost- it is probably still cheaper to push out the Fortigate cert than to buy your own CA Cert.

     

    If you have a Windows domain then the certificate can be pushed out via group policy I believe. If you have a domain you may also be able to create your own certificate using the windows server certificate authority in that case.

     

    For smaller business without domains there are are solutiions- for example Microsoft Endpoint Manager allow you to manage device compliance and push out certificates to devices.

     

    Hope that helps.

     

     

    Andy.

     

     

     

     

     

     

    TecnetRuss
    TecnetRuss
    Visitor III
    September 22, 2020

    If you are looking to buy a "CA" certificate from a trusted vendor like Comodo or Digicert that will already be automatically trusted by your client devices like other Comodo or Digitcert-issues certificates and that your FortiGate can use for DPI, then no, this is not possible.  3rd party SSL vendors do not sell "CA" certs.  This would be dangerous as it would allow almost anyone to act as a trusted CA and issue spoofed certificates that anyone would trust.

     

    As Andy suggests, if you have your own internal CA you can issue yourself one and import that into your FortiGate.  If your devices already trust your CA then they'll trust DPI certificates issued by your FortiGate.  But I find it's just as easy to export the built-in FortiGate CA certificate and distribute it to all my domain-joined devices via GPO.

     

    Russ

    mbence84
    mbence84Author
    New Member
    September 22, 2020

    And then you have this which is confusing, the third option?

     

    https://kb.fortinet.com/kb/documentLink.do?externalID=FD37095

     

    itchubbarabia
    itchubbarabia
    Visitor III
    July 7, 2024

    hi dears,

    I think I have a very close case and really, I stuck with thinking much about how to figure out the matters.

    so, I have a datacenter firewall "FortiGate" which is inspecting traffic between client and Mail server. SMTP traffic is using public certificate "bought thru comodossl" and configured on mail server. so, now I got a huge logs on FortiGate regarding ssl inspection and we figure out that issue with certificate inspection so now really want to decide where to use the public certificate for the inspection in this case should be mounted as local CA certificate on FortiGate or to disable "Server certificate SNI check"

    what's your suggestion??

    Terms & ConditionsAccessibility statement