Own certificate for web filter in FortiClient possible?

[Magion]

I have a test setup with EMS 6.2.6 and FortiClient 6.0.10. When enabling the web filter in the config, I get a certificate warning on the client pc because of the untrusted certificate used by FortiClient. It's a self signed certificate of the FortiClient itself.

Is it possible to select/configure a different certificate (we have an internal pki) for web filter use?

I found a few similar topics but they all where about the web filtering using FortiGate. However this is a FortiClient/EMS only setup.

[Kenundrum]

Yes you can do this. In the EMS, go to the policy components menu and the CA Certificates section. You can upload a CA Cert that is trusted by the clients. The type of certificate is exactly the same as the one you would create for use with FortiGate SSL inspection- typically a Sub-CA of your internal trusted CA.

In each profile, the system settings tab "Other" section is where you would choose which CA certificate would be sent to the client and used for local web filtering.

[Magion]

Oooh, is that what CA certificates is for??   Duh! Totally missed that.

Gonna try it out right now!

[Magion]

Hmm... nope... not working. The certificate shown in the browser is still the self signed certificate.

[Jamie_P]

Hi Magion,

Did you have any movement on this at all? I have the same issue with wanting to use a trusted certificate / CA. I feel like I've been through the options several times and can't find anything obvious.....

Thanks,

J.

[Magion]

Sorry no.

Also, even though I'm currently evaluating EMS, since I don't have a FortiClient license (yet) I cannot contact support for this.

[ryan_www]

I ran across this post after experiencing a similar issue on FortiClient 7.2.3 on MacOS.  There is a known bug at the moment for FortiClient 7.2.3 on MacOS where the locally generated web certificate is created, but can't be set to trusted if installed while a non-admin user is logged in.  Support confirmed that it is not possible to use a centrally managed certificate.  Hopefully they can add an option like this as it seems like it could be more reliable to use a centrally managed certificate pushed by MDM.  Seems dangerous to hope that the OS does not un-trust the locally generated certificate.  

[gunthest]

This is the exact issue I am having. Support told me this is part of their new web filtering system, not that it was a bug.  This is disastrous. Hopefully they get it together and address this. 

[Ragman]

We have also run into this bug using FortiClient 7.2.3. Has there been any movement from Fortinet regarding this issue.

[ryan_www]

Last month, support told me it was being actively investigated as a bug and there was no workaround.  I think it is bug 950099 in these release notes.  https://docs.fortinet.com/document/forticlient/7.2.3/macos-release-notes/124818/known-issues