HTTPS Deep Scanning and certificate errors

[Frosty]

On my FG200B I am now running v4.0 MR3 Patch 5. I' ve been using HTTPS content inspection ever since v4.0 MR2 Patch 2 and we' ve always had intermittent problems with it. Most of the time it works fine, but intermittently we get a browser error warning the the certificate is not trusted; if we proceed anyway, things always work, but I am struggling to understand why this problem exists and why it is intermittent. I have exported the FGT' s main certificate named " Fortinet_Factory" and also the signing CA certificate named " Fortinet_CA" . These have been deployed to all PCs using a GPO. I' ve also tried adding the certificate named " Fortinet_CA_SSLProxy" to this list of certs rolled out via GPO (didn' t seem to make a difference). Can anyone explain to me, in hopefully simple terms: (1) why I am getting these errors with the HTTPS Deep Scanning; (2) why the problem seems to be intermittent; and (3) is there anything I can do to permanently fix it, or am I stuck with it I have a support ticket open at the moment on this, and Support have referred me to a document " UTM Guide version 4.3" pg194 ... which I have read several times now ... but I still do not understand why it is the case that the problem is intermittent.

[izatt82]

just a question are the site you are going to doing mutual auth? figured i would ask we had problems with deep packet inspection of ssl because it has to do a MITM which breaks when using mutual auth.

[Fortinet_SV]

Thank you

[astibal]

Hello Stephen, maybe I am wrong, I didn' t read all this post really carefully, but I think you may be hitting authentication of internal user. I was solving similar problem recently. Fortinet certificate has been occasionally there, even if everything just only touching SSL inspection has been turned off. I reallized, that it was there because user was opening https site, while his IP was unauthenticated AND traffic has being authenticated using identity rules. This was triggering user authentication, which was set to HTTPS too (in USER->Authetication). This is perhaps the reason, why you got self-signed certificate instead of the SSL_Proxy cert. Could you reach destination SSL page after accepting that certificate (no logon page, etc)? Could you turn off user authentication on HTTPS and share the result? -ales

[Rafael_Rosseto]

Hi all, How this problem goes, I have same here. When I enable deep scan, it works fine, then suddenly FG changes the Fortinet_CA_SSLProxy to a certificate like FG20BXXXXXXXXXX. Anyone knows how to solve this case?

[acf1210]

I have same here.

[bmann]

Hi Stephen, as astibal wrote. This is because of user authentication. When user is not authenticated and goes first to ssl site, then FG intercepts this request and presents certificate like FG200BXXXXXXXX So use non SSL traffic to authentication. If you use FSSO, do not enable NTLM on the same policy. For now I do not know about any effective solution to this certificate warnings.

[billp]

We have a similar issue also. We usually tell the user to visit their favorite news site --- like cnn.com -- to " fix" the problem. If you set the browser to bring up a home page that is non-ssl, it would also effectively work around the problem I believe.