Issue with FortiOS v7.2 Using Default Certificate Instead of Uploaded CA Certificate

[jesusangel]

Hello,

I hope this message finds you well.

Below is the detailed information regarding the issue we are experiencing with our Fortigate 6300F with FortiOS 7.2:

1. Detailed Problem Description

We are using a Fortigate 6300F configured as an explicit proxy. The Fortigate restricts access to certain categories, such as Instant Messaging (e.g., https://zoom.com). When a user attempts to access these restricted categories, a warning page is displayed. The Fortigate generates a certificate signed by a custom CA certificate that we uploaded (not the default one).

However, after the user proceeds past the warning page and is redirected (e.g., to https://zoom.com:8010), the Fortigate uses the default certificate instead of the custom CA certificate.

Please note that we have cloned all the default SSL inspection profiles and configured them to use our generated self-signed CA certificate. We are only using the certificate inspection profile, not full inspection.

We would like to ensure that the Fortigate always uses the custom CA certificate for all connections, including those that are redirected after warnings.

2. Relevant Background Information

• This is a new configuration and has not worked as intended in the past.
• No recent changes have been made to the Fortinet device or the network apart from configuring the custom CA certificate.

3. Troubleshooting Steps and Results

• Step 1: Verified that the custom CA certificate was uploaded and configured properly.
  • Result: The warning page uses the custom CA certificate as expected.
• Step 2: Tested bypassing the warning page and accessing the blocked URL (e.g., https://zoom.com:8010).
  • Result: Fortigate used the default certificate instead of the custom CA certificate.
• Step 3: Checked SSL inspection profiles to confirm that our cloned profiles are being used.
  • Result: The profiles are correctly configured, using our self-signed CA certificate, but the issue persists.

Thank you for your assistance.

Best regards,
Jesús Ángel

[johnathan]

Are you able to confirm the SSL profile is configured as per https://community.fortinet.com/t5/FortiGate/How-to-use-custom-certificate-for-FortiGate-Block-pages/...