Technical Tip: How to enable deep inspection and import a certificate in the browser

[carabhavi]

Description

This article describes how to enable a deep inspection profile in the Firewall Policy and import the certificate in the browser to avoid certificate warnings.

Scope

FortiGate.

Solution

When in the policy multiple security profiles is being added and a full SSL inspection or 'deep-inspection' profile is required to be used a message will be shown in the policy that the endpoint user may experience a certificate warning. To get rid of the warning the certificate that is being used in the security profile in SSL & SSH inspection needed to be installed in the trusted root certificate store of the endpoint.

As the full SSL inspection certificate mostly requires a certificate generated by private CA the browser might not trust the certificate that is being used for the inspection which leads to the work of inserting it into the trusted root certificate on the workstation.

Here is an example of the error that  can appear in the browser for a certificate that is not trusted and is being used for full SSL inspection:

To import the built-in certificate (Fortinet_CA_SSL) to the browser:

1. On the FortiGate, go to Security Profiles -> SSL/SSH Inspection and select 'deep-inspection'.
2. The default CA Certificate is Fortinet_CA_SSL.
3. Select 'Download'.
   
   

4. On the user's computer, select the downloaded certificate file and select 'Open'.
5. Select 'Install Certificate' to launch the certificate import wizard and use the wizard to install the certificate into the trusted root certificate authorities store.

If a security warning appears, select 'Yes' to install the certificate.

Note:
Install a certificate with trusted root authority only.

The image above explains the steps to enable deep inspection in the Firewall Policy.

These steps are as follows:

6. On the FortiGate, go to Policy & Objects -> IPv4 Policy and edit the policy. Starting from FortiOS 6.4.0, it is under Policy & Objects -> Firewall Policy.
7. Under the section 'SSL Inspection', select 'deep-inspection'.
8. Select OK to save the changes.
   
   

Refer to this document for more information:

Obtain, setup, and download an SSL certificate package from a certificate authority

Continuing the Importing Certificate section:

 

4. Upload the local certificate file, then select OK.
5. The status of the certificate will change from PENDING to OK.
6. Select Import -> CA Certificate.
7. Set the Type to File, upload the CA certificate file, and then select OK.

   The CA certificate will be listed in the CA Certificates section of the certificates list.

Important Note:

Deep inspection only works if there is at lest one Security Profile enabled. Without a Security Profile enabled, deep inspection is not triggered.

Related articles: 
Technical Tip: How to import the CA certificate for full SSL inspection

Technical Tip: Installing Private CA for Deep inspection