Certificate for https traffic

[v20100]

Not sure it is in the correct thread. Running on 200D 5.4.8   This is mainly for AV. In order to detect viruses, we needed to add the SSL/SSH inspection and by selecting "Certificate Inspection", the firewall now detects viruses but only for non encrypted traffic. As most of the traffic is now via https, we need to select instead "Deep Inspection" However, all the sites now come with certificate errors. The engineer assigned to our case, told us that we need to install the Fortigate certificate on all our workstations, which is not really possible. too many devices (windows, IOS, MAc and Android) and too many browsers He said the alternative was to purchase a CA certificate and install it, but was not able to advise further.   Have many of you used that technique? I am guessing that it becomes more and more common to implement viruses/malware scanning at the gateway level, and this would be the easiest method now that 90% traffic is encrypted?   What CA would you recommend? We already have a 'standard' certificate installed on the Fortigate for SSLVPN to avoid the errors. When requesting the CA certificate, do we also use the same DNS name? And it will not interfere with the current cert installed for SSLVPN?   Thanks in advance

[Philippe_Gagne]

Hi,

I deploy really often the Deep-inspection solution. You don't need to buy a CA certificate. There is someway to archieve the goal:

- Have a CA Certificate in your Active Directory.

or

- Build you own CA certificate and deploy it in the GPO in the Trusted Root Certificate. That's is my prefered!

SSLVPN and CA are used in two different purposes. The CA certificate is used to decrypt and then re-encrypt the traffic to the destination computer. That's the reason computers have to trust this CA as a known trusted CA.1

To create a CA certificate, I'm using XCA, it works really fine: https://sourceforge.net/projects/xca/

Have a nice day.

Philippe

[MAK]

Hello everyone,

We are doing A/V on our FortiWiFi60E running FortiGateOS 6.0. Already purchased a SSL cert from a public CA authority. However, have problem uploading it into the Certificate DB into Forti60E. The CA authority send a wildcard cert for our company along with an Intermediate CA cert. The wildcard cert loads into Forti60E Certificate DB in the Certificate top sections, while the Intermediate CA certs loads into the External CA section. However, when selecting in the policy for SSL deep inspection, only the Local CA cert Forti_CA_SSL shows in the drop down list! which is the default builtin Fortinet cert. How can we select from External CA section for the SSL deep inspection cert??? Any help would be appropriated.

PS We do have a local CA running, but this would require uploading local CA cert into every device, which is not desired. 

[ShawnZA]

Create a browsing rule for yourself only, and enable the deep inspection and select the VPN cert and see if you get errors.... but if they recomend a CA cert then it might still cause issues seeing you say it's a "standard" cert.

CA cert will not cause issues with your VPN cert as you will not be asigning the CA cert to the VPN config...

We rolled out the Fortigate cert (what a mission that is) so we are using that for now, but will probably also go the CA route at some point as installing the fortigate cert on devices is becoming a mission

[emnoc]

Wait

Do what was said b4 build your own CA and you still need to have that certifcate installed and trusted on the client. So no matter what  you do, you ( private SelfSign or whatever ) the clients will need the certificate trusted.

The other option ( please don't do  this ) is to remove  certificate validation from the client, You could do this but now any  site would be valid since no validation has taken place

That would be the iequal of  curl -k for example.

The engineer assigned to our case, told us that we need to install the Fortigate certificate on all our workstations, which is not really possible. too many devices (windows, IOS, MAc and Android) and too many browsers

You have a CA certificate on the fortigate now, export that one if you don't want to  craft a new one. When support tells you these things they should explain and process.

http://docs-legacy.fortinet.com/fos40hlp/41/wwhelp/wwhimpl/common/html/wwhelp.htm?context=fgt&file=s...

http://socpuppet.blogspot.com/2016/10/a-quick-and-sure-to-know-if-ssl.html

and FWIW, no  commercial CA will blindly give you a CA intermediate  certificate  under normal means. Going to   godaddy for example and buying a certificate is a "web server" certificate not a CA cert. So keep that in mind.

Ken

[MAK]

So if I understanding A/V SSL deep inspection correctly, cannot be done unless is a local CA root authority certificate? public CA authorities such as Godaddy, only give intermediate CA cert, which does not contain the private key, hence no good for A/V SSL deep inspection?? Yes or No?

Thanks

[kurtli_FTNT]

Hi there, 

   If you want to "see" the content of outgoing https traffic then installing CA into clients is mandatory whatever the CA is yours or from FGT. This is because FGT now needs to do the deep-inspection with certificate re-sign. If you only need to check the Url then certificate-inspection can meet.

Thanks. 

[kurtli_FTNT]

Hi MAK,

   If you want to use your CA to do the certificate re-sign rather than the build-in one , you have to upload both the CA and key. This is because FGT will use the 'key' + CA info to re-sign the certificates coming from outside world. And yes, the public CA authorities usually won't give you the key of intermediate CA cert because if you have that key on hand, then you can sign other certificates with it as well, which means you become a sub CA authority.  

[v20100]

Thanks everyone

Still confused on what we can do or not!

As mentioned in the original post, we cannot deploy the certificates to clients, as we have too many device types, and many not on AD/GPO.

I find it strange that Fortinet does not have a built-in public certificate that should be used for this. Surely, if it says it can scan for viruses/etc on the fly, it should provide the facility out of the box!

It sounds it is technically difficult to implement this.

Kurtly_ftnt, you seem to have managed to get it going without deployment to each devices. Sorry my knowledge about 'certificate' is not that great. Can you please elaborate on the steps to upload the CA and Key?

Anybody has been able to get AV scanning for HTTPS traffic without deploying certificate to each devices and browsers?

Thanks

[emnoc]

I find it strange that Fortinet does not have a built-in public certificate that should be used for this. Surely, if it says it can scan for viruses/etc on the fly, it should provide the facility out of the box!  

They ( FTNT ) has SelfSign Certificate CA type not public known. if they did what you  are asking they would have to pay big bucks to  join WEBCAB to have their CAcert trusted by all of those devices "you  need the cert on", since you don't want to distribute the cert. FTNT is not in the business as a CA.

It sounds it is technically difficult to implement this.  

No.  it's really not that hard ;) Your understanding of the process is not clear. You injecting a MiTM  is not something done easily if you want it to work. You don't wake up and deploy a HTTPS MiTM device and  think it's going to work much like a US SPACE Program doesn't place a rocket engine on a pair of wings and think it will fly to mars ;)

You do have one more option that could be explored, and  which requires NO cert and only will work for  HTTP/HTTPS/FTP  but has other gotchas

If your goal is to inspect HTTPS/HTTP , defined the fortigate as explicit proxy and then you can  do all that you want with out deploying certs across devices. You will still need to publish the proxy to the clients which is the gotcha ( WPAD or PAC )