Certificate inspection: untrusted certificate warning broken (5.4.5)

[Zac67]

When you've activated certificate inspection or deep SSL inspection, the acceptance of the external certificate is up to the FG. When it rejects the external certificate it the page with the warning:

"This Connection is Untrusted ..."

You can check this e.g. on https://self-signed.badssl.com/

However, for this page's certificate the FG always uses a certificate signed by the factory "Fortinet Untrusted CA", regardless of what you've set up for HTTPS or SSL inspection.

According to support (ticket #2289811), this is not configurable. In my humble opinion, this function is broken since it urges the user to (permanently) accept a root certificate which is present - and extractable - on every Fortigate on the planet, leaving a critical vulnerability for man-in-the-middle attacks.

Are there any ways around this? Is this issue addressed in 5.6?

[bommi · Accepted solution]

Hi,

I just checked this, but I cant change the Untrusted CA Certificate in 5.6.1.

Regards

bommi

[rdumitrescu · Accepted solution]

Hi Zac67,

By default the firewall use an "Untrust CA" for the websites that have broken certificate. (as your example "https://self-signed.badssl.com/")

You can change that from CLI:

config firewall ssl-ssh-profile edit "--your profile--" set untrusted-caname "your trusted CA" end

In this way you will avoid the certificate warning. (If you have installed on the PC the "trusted CA")

Still, the best practice says to warning the users when they are going to an "untrust" (faulty certficate) website.

So you should find your best compromise between usability and security.

Regards Radu

[FAPM · Accepted solution]

Hi,

I am in version 5.6.2 and I have the same problem ... 

[bommi · Accepted solution]

Hi,

I just checked this, but I cant change the Untrusted CA Certificate in 5.6.1.

Regards

bommi

[Zac67]

Pity - thanks for the feedback!

[dmcquade]

The problem is you are using the default CA cert on the Fortigate. You could download this and add to your workstations as a trusted CA cert. Although named the same, it is NOT the same cert on all Fortigates.

I've implemented this by generating a CSR on the Fortigate and submitted it to the local network PKI to create a CA Cert using an ICA already trusted by the workstations. Import this into the Fortigate and the workstations will not receive the Untrusted Cert message.

[rdumitrescu · Accepted solution]

Hi Zac67,

By default the firewall use an "Untrust CA" for the websites that have broken certificate. (as your example "https://self-signed.badssl.com/")

You can change that from CLI:

config firewall ssl-ssh-profile edit "--your profile--" set untrusted-caname "your trusted CA" end

In this way you will avoid the certificate warning. (If you have installed on the PC the "trusted CA")

Still, the best practice says to warning the users when they are going to an "untrust" (faulty certficate) website.

So you should find your best compromise between usability and security.

Regards Radu

[Zac67]

Thanks for your suggestion, Radu! "Untrusted-caname" was the keyword, now I can also find at least a cursory mention in the manual under Inspection Exemption(!) - support wasn't able to point me there.

Setting untrusted-caname to the (working) SSL-inspection-certificate didn't work. Now the warning page can't load any more at all (keeps connecting forever). Even an unset untrusted-caname doesn't fix this. But it's definitely the right track: Certificates in the GUI counts one reference less to the Fortinet untrusted CA cert and one more for ours. I'll investigate further.

[Zac67]

Radu: even though the "Untrusted-caname" option didn't work right away, it did start working at some time later on. I just stumbled on a page with an incomplete certificate chain (intermediate cert missing) and wondered why I could read the FG's warning - checked the certificate and it's ours! THANK YOU!!

[rdumitrescu · Accepted solution]

Hi Zac67 glad to hear that you managed to solve the issue. Just after that you modified the "Untrusted-caname" it may be that your browser has the web server certificate cached, that's why it started to work later.

Cheers Radu

[Zac67]

Well, I restarted Firefox (I know that deleting the cache and shift-ctrl-R don't always force a certificate reload or SSL renegotiation) and also tried a second PC - somehow the setting didn't catch right away. Possibly the FG had retained some connection data for a short while, I don't know.

We didn't test long, just a few minutes; I guess we should have tested a bit longer.

[ZANOOB]

Hi , I am having the same problem.

But it is for non responsive sites , the fortigate try to send a 504 message back to client machine.

But the client client machines are presented with Fortigate certificate and hence the warning message on clients.

I tried to change the untrusted-caname to a certificate that is trusted by clients (example : Digicert CA certificate).

But when i try the command

config firewall ssl-ssh-profile edit "My SSL inspection" set untrusted-caname "Digicert CA"

I get the error that the certificate is not in the store.

I downloaded the Digi cert CA to the certificate store in Fortigate using the import option under certificate and choose option "CA Certificate" and imported the CA certificate , but that is going under "Remote CA certificate"

Hence, when running the above command it gives "me entry not found in datasource" . I can only use a certificate that is inside the "Local CA certificate" store and not inside "Remote CA Certificate" store.

Fortigate does not allow to import a certifcate under "Local CA certificate".

How did you import the certificate to local CA certificate store  or how did it allow you to run this command ?