Guidance needed on Fortigate Web Filtering and certificate error on Chrome

[IceMan]

I have a created a Firewall Policy to block some URLs, and selected "certificate-Inspection" for SSL. When a client PC tries to access the blocked URLs, I want them to view our custom 'access denied' page but instead Edge/Chrome gives this error page instead. How do i fix this? A step by step instruction would be great.

[tthrilok · Accepted solution]

Hi Iceman,

Thank you for your query!

I understand you are not seeing the blockpage from the Fortinet, when the users are trying to access any blocked website.

This is because, when the firewall blocks any website by UTM, firewall sends its certificate, where the CN will be the firewall serial number. In order to see the proper block page. You may import the "Fortinet_CA-SSL" certificate from the firewall to trusted store of the browser and test.

Please keep us posted, if it works!

[IceMan]

Hi tthrilok, I got it to work the way you suggested.

Once I do this for all client PCs, will it be valid throughout the certificate validity date, in my case it says up to year 2030? Like if I make changes to policies and other settings in the firewall, do I have to export and install the certificates again?

[akumarr]

Hi Iceman,

Like if I make changes to policies and other settings in the firewall, do I have to export and install the certificates again?   >>> No, it is not required to reimport the cert if you make any changes on the firewall.

But please make sure you have imported the correct ssl/ssh deep inspection profile certificate.