Technical Tip: How FortiGate handles 'Untrusted SSL certificate' option under SSL inspection profile

[athirat]

Description

This article describes the options available to handle Untrusted SSL certificate on FortiGate Deep SSL-inspection profile

Scope

FortiGate.

Solution

When the certificate verification issue appears it will display the following logs in the event logs for SSL events and the event type 'ssl-anomaly' will appear in the correspondent field with log ID 1700062302. 

date=2023-05-02 time=16:08:01 eventtime=1683061680985416370 tz="-0500" logid="1700062302" type="utm" subtype="ssl" eventtype="ssl-anomaly" level="notice" vd="root" action="resign-as-untrusted" policyid=20 poluuid="da23f9f0-7c2e-51ed-ec49-277a332ec2af" policytype="policy" sessionid=16436357 service="SSL" profile="custom-deep-inspection" srcip=10.195.161.20 srcport=54710 srccountry="Reserved" dstip=152.99.166.196 dstport=443 dstcountry="United States" srcintf="Interface-1" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" srcuuid="307fa87e-71a6-51ec-9530-eef5256c29ef" dstuuid="9a4bc3b8-2b89-51ec-d015-7b3b2366ae1a" proto=17 tlsver="tls1.3" sni="outlook.office.com" cipher="0x1302" authalgo="rsa" kxproto="ecdhe" eventsubtype="certificate-anomaly" msg="Server certificate is re-signed as untrusted, certificate-status: untrusted " hostname="outlook.office.com"

When FortiGate cannot successfully verify the server certificate (For example: untrusted root CA, expired, self-signed certificate), the below options are available on FortiGate to handle this situation:

1. Allow: When FortiGate detects an Untrusted SSL certificate in the Server Hello, it generates a temporary certificate signed by the built-in 'Fortinet_CA_Untrusted' certificate. This temporary certificate is then sent to the client browser which results in the warning to the user that the site is untrusted.

The certificate used can be changed only via CLI as below:

config firewall ssl-ssh-profile
    edit "custom-deep-inspection"

        set caname "Fortinet_CA_SSL" <----- Used when FortiGate can verify the server certificate.
        set untrusted-caname "Fortinet_CA_Untrusted" <----- Change the certificate to one that should be used for untrusted connections.
    end
end

2. Ignore: No change in behavior as compared to a Trusted SSL certificate.FortiGate will use the default name 'Fortinet_CA_SSL' to create the temporary certificate.

3. Block: FortiGate blocks the connection if the server certificate can not be verified.