Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
IceMan
New Contributor

Guidance needed on Fortigate Web Filtering and certificate error on Chrome

I have a created a Firewall Policy to block some URLs, and selected "certificate-Inspection" for SSL. When a client PC tries to access the blocked URLs, I want them to view our custom 'access denied' page but instead Edge/Chrome gives this error page instead. How do i fix this? A step by step instruction would be great.

 

Screenshot 2022-08-29 092024.png

 

 

1 Solution
tthrilok
Staff
Staff

Hi Iceman,

 

Thank you for your query!

 

I understand you are not seeing the blockpage from the Fortinet, when the users are trying to access any blocked website.

 

This is because, when the firewall blocks any website by UTM, firewall sends its certificate, where the CN will be the firewall serial number. In order to see the proper block page. You may import the "Fortinet_CA-SSL" certificate from the firewall to trusted store of the browser and test.

Please keep us posted, if it works!

View solution in original post

3 REPLIES 3
tthrilok
Staff
Staff

Hi Iceman,

 

Thank you for your query!

 

I understand you are not seeing the blockpage from the Fortinet, when the users are trying to access any blocked website.

 

This is because, when the firewall blocks any website by UTM, firewall sends its certificate, where the CN will be the firewall serial number. In order to see the proper block page. You may import the "Fortinet_CA-SSL" certificate from the firewall to trusted store of the browser and test.

Please keep us posted, if it works!

IceMan

Hi tthrilok, I got it to work the way you suggested.

 

Once I do this for all client PCs, will it be valid throughout the certificate validity date, in my case it says up to year 2030? Like if I make changes to policies and other settings in the firewall, do I have to export and install the certificates again?

 
 
akumarr
Staff
Staff

Hi Iceman,

Like if I make changes to policies and other settings in the firewall, do I have to export and install the certificates again?   >>> No, it is not required to reimport the cert if you make any changes on the firewall.

But please make sure you have imported the correct ssl/ssh deep inspection profile certificate.

Best regards,
ARUNKUMAR.R.