Technical Tip: How to import a FortiGate deep SSL certificate in the system

[mpandya]

Description	This article explains the procedure to import a FortiGate deep SSL certificate.
Scope	FortiGate.
Solution	Importing a FortiGate Deep SSL Inspection certificate into a system involves multiple steps. Deep SSL inspection involves intercepting and decrypting SSL/TLS traffic to inspect its contents for security purposes. Note that these steps can vary based on the specific FortiGate version and the operating system in use. Below is a general outline of the process: Obtain the SSL certificate: Obtain the SSL certificate that the FortiGate unit uses for deep SSL inspection. This could be a self-signed certificate or a certificate signed by the organization's Certificate Authority (CA).                                                                             Export the SSL certificate: Export the SSL certificate from the FortiGate unit. This can typically be done from FortiGate's web-based management interface or command-line interface (CLI). Copy the certificate to the system: Transfer the exported SSL certificate and private key to the local system. It is recommended to use secure methods like SFTP, SCP, or a secure file-sharing service. Import the Certificate: On Windows: Open the Windows 'Certificate Manager' (certmgr.msc) service as an administrator. Navigate to the 'Trusted Root Certification Authorities' or 'Personal' store, depending on where the certificate is to be installed. 'Right-click' on the store and choose All Tasks -> Import... Follow the wizard to import the certificate. Make sure to select the option to include the private key if applicable.                                                                                                   On Firefox:  If the Firefox browser is in use, the certificate must be installed directly in the browser itself. Launch the Firefox browser Select the menu button (three horizontal lines) in the upper right corner, and select Settings.  Scroll down and select 'Privacy & Security' in the left sidebar. Use the search bar to search for 'Certificates'. In the Certificate Manager window, go to the 'Authorities' tab, select the Import button and navigate to the location where the FortiGate certificate file is saved, select it, and select 'Open'.                                                                                                                                   On macOS: Open the 'Keychain Access' application. Go to the 'File' menu and choose 'Import Items...'. Browse to the certificate file exported earlier and import it. Make sure to import it to the appropriate keychain (such as 'login' or 'System'), depending on the use case. On Linux: Depending on the Linux distribution and desktop environment, there may be different tools to manage certificates. On GNOME-based desktops, the 'Seahorse' application can be used. Open the certificate manager and import the certificate. Trust the Certificate: It may be necessary to mark the certificate as trusted to ensure that the system trusts the FortiGate SSL certificate for deep SSL inspection. This step can involve moving the certificate to a trusted store or adjusting trust settings. Restart Applications: In some cases, it may be necessary to restart the web browser or other applications that use SSL/TLS to establish connections. This will ensure that they recognize the newly imported certificate. Note that the specific steps can vary depending on the operating system, FortiGate version, and the organization's security policies. Always follow the organization's guidelines and best practices for certificate management.