Creating a certificate with keyusage=certsign or Subordinate Certification Authority?

[hoyty]

I was pointed to http://docs.fortinet.com/uploaded/files/2041/using-a-custom-certificate-for-SSL-inspection.pdf by support when I asked about using cert for ssl inspection. Are these instructions only meant for someone who has an internal CA that is trusted by clients? It seems that no Public SSL CA company would grant this type of cert. If that is the case the directions don't really say that. I am just trying to do web filtering of my clients and was hoping to not have to install cert on them.

Also how does it work with web filtering on guest network / byod where you can't install cert on client machines?

[oheigl · Accepted solution]

Short answer to your question: Yes. The reason why you need an internal CA is because otherwise the whole certificate system used in the web wouldn't be worth anything. If there would be a public CA which is trusted by default within the OS and issues certificates for every website to every person there would be no reason to verify a certificate, because everybody could get one for every website. That's why a public CA verifies if you are really the owner of the domain you are requesting a certificate from.

If you don't want to install a certificate on all your clients you could use certificate inspection - this option doesn't decrypt the SSL connection, it only checks for the CN in the provided certificate from the web server. Also if you have a windows environment it's not that big of a deal to setup a CA certificate and roll it out to all clients via group policies. 

Regarding BYOD: That's always a big issue, some companies don't enable the SSL decryption, others are forwarding to a website via the disclaimer to download the CA certificate before browsing and with manuals to install the CA certificate, it's really your own decision what you want to accomplish and what your security needs are.

Hope that helps!

[hoyty]

Thanks for the confirmation of my fears. I am probably happy with cert inspection for bad sites. The problem I have is if a user goes to a https site and it is blocked by web filtering agent based on URL / IP the client is presented the Fortinet cert and the user gets warning / error depending on browser. Can I used my purchased cert in that scenario when the users gets redirected to "blocked" page?