|
What mTLS authentication is:
mTLS (Mutual TLS) authentication is used to mutually authenticate both the client and the server [FortiWeb's server policy] by exchanging and validating certificates during the TLS handshake.
The difference between TLS and mTLS:
Typical TLS (HTTPS): FortiWeb presents the server certificate to the client only.
mTLS: FortiWeb presents the server certificate to the client And the client presents its client certificate to FortiWeb together to perform mutual TLS authentication.
How to perform mTLS authentication:
- Part 1: FortiWeb presents its server certificate chain to the client to achieve Server authentication.
- Part 2: The client presents its client certificate to FortiWeb to achieve Client authentication.
How to configure mTLS authentication on FortiWeb:
Part (1) Configure FortiWeb to present the server certificate chain:
- Import both the intermediate and the root certificates at Server Objects -> Certificate -> intermediate CA.
Note: Importing only the Intermediate certificate sometimes can be enough however it is recommend to import both the Intermediate and the Root certificates.
- Assign the Intermediate and the Root certificates in a Intermediate CA group at Server Objects -> Certificate -> Intermediate CA Group.
- Import the Server certificate at Server Objects -> Certificate -> Local.
- Assign the complete certificate chain at the server policy: Policy -> Server Policy -> Choose the related policy: Assign the imported certificate chain at 'Certificate' and 'Intermediate CA group'.
Part (2) Configure FortiWeb to request the client certificate:
- Import the CA Intermediate/root certificate generated from CA that issued the client certificates at Server Objects -> Certificates -> CA.
- Apply the imported CA certificate to a CA group at Server Objects -> Certificates -> CA -> CA Group.
- Apply the CA group to a Certificate Verify at Server Objects -> Certificates -> Certificate Verify.
- Apply the Certificate Verify in the server pool Policy -> Server Policy -> Choose the related policy -> Advanced SSL Settings -> Certificate Verification for HTTPS.
Related documents:
How to apply PKI client authentication (personal certificates)
How to enable Client Certificate Verification in FortiWeb Server Policy
CA certificates
Related Fortinet Library video:
Validating Client Certificates with mTLS Support
|
