How to use a different certificate instead of FORTINET_CA_SSL?

[raffaeledp]

Hello everybody,

I'm struggling with deep packet inspection. My scope is not to use the FORTINET_CA_SSL certificate. But there is one thing I don't understand:

only the certificates under the "Local CA Certificates"section can be used? Can't I use the certificates under the "Remote CA Certificates" section? If not, what kind of certificates can be added to the Local CA Certificates section?

It's not deeply clear to me the difference between the two sections. 

Thank you for your help!

[jiahoong112 · Accepted solution]

FORTINET_CA_SSL has a field in it which is CA:True. To achieve this, you will need to configure your own Certificate CA Server. You can use Windows Server CA or FortiAuthenticator to achieve this. You will then have to import the root or intermediate certificates generated by the CA into Fortigate.

Refer here on how to import the CA certificate properly such that you are able to use it for deep-inspection purposes: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-the-CA-certificate-for-full-... 

Public CA like digicert etc will never provide their CA certificate where CA:True.

[jiahoong112 · Accepted solution]

FORTINET_CA_SSL has a field in it which is CA:True. To achieve this, you will need to configure your own Certificate CA Server. You can use Windows Server CA or FortiAuthenticator to achieve this. You will then have to import the root or intermediate certificates generated by the CA into Fortigate.

Refer here on how to import the CA certificate properly such that you are able to use it for deep-inspection purposes: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-the-CA-certificate-for-full-... 

Public CA like digicert etc will never provide their CA certificate where CA:True.

[issa00 · Accepted solution]

Hope you will get a idea from below:

First, answers for your questions:

1. Only certificates under the "Local CA Certificates" section can be used for SSL inspection on Fortinet devices. Certificates under the "Remote CA Certificates" section cannot be used for SSL inspection purposes.
2. The "Remote CA Certificates" section is intended for storing certificates of external Certificate Authorities (CAs) that your Fortinet device can use to verify certificates presented by remote servers or clients during SSL/TLS handshakes. These certificates are not suitable for SSL inspection directly on the Fortinet device itself.
3.  You can add certificates that are issued by a local Certificate Authority (CA) that you manage and trust internally. These certificates can be used for various purposes including SSL inspection, VPN authentication, and other security functions managed by the Fortinet device.

• FORTINET_CA_SSL: This is the default certificate used by Fortinet devices for SSL inspection. It typically has the CA (Certificate Authority) flag set to True, indicating that it is a certificate authority capable of signing other certificates.

• Configuring your own CA: To use a different certificate instead of FORTINET_CA_SSL for SSL inspection, you would need to set up your own Certificate Authority (CA). This can be done using tools like Windows Server CA or FortiAuthenticator.

• Importing certificates: Once you have set up your CA, you would generate root or intermediate certificates using this CA. These certificates should then be imported into the "Local CA Certificates" section of your Fortinet device. This ensures that your Fortinet device trusts certificates issued by your own CA for SSL inspection purposes.