Can I use CA Certificate (e.g., DigiCert, GlobalSign, etc.) for Deep Inspection?

[FG-PioneerClient]

Hello,

Can I use CA Certificate (e.g., DigiCert, GlobalSign, etc.) for Deep Inspection?

instead of using the Self-Signed Fortinet Certificate on  FortiGate v6.2.1

Anybody used CSR to buy a Certificate from a well known CA, and installed it on the FortiGate v6.2.1 to be installed on the end users for DEEP INSPECTION ?

Thanks n advance ...

[James_G]

You cannot do this, the cert for deep inspection needs to be a root cert, no 3rd party is going to give you a root cert.

[sw2090]

it can also be a sub CA. This alas will require the clients to have the certificate chain installed in order to verfiy the certificate and trust it.

Works fine here with sub ca from our internal ca with all clients having the ca certificate from our ca installed.

[sw2090]

This is because if you want to do deep inspection you have to be man-in-the-middle. So you need to decrypt the original incoming connection but also hand it on to the client requesting it encrypted.

For this you need to be able to sign certificates and that requires a root or sub ca.

[emnoc]

A 3rd party is not going to give you a root or intermediate-root certificate as far as that goes.

Use MS-domain-certificate or openssl and craft your own and load it up on your clients.

Ken Felix

[FG-PioneerClient]

NOTED,  Thank you ...