Public Signed SSL certificate for SSL deep inspection

[mbence84]

Can this be done, public Signed SSL certificate for SSL deep inspection on foritgate . Is this possible so that there is no import needed on client devices.

[andrewbailey]

Hi mbecne84,

Yes, you can use your own certificate- but it needs to be a CA (Certificate Authority) certificate (ie one that is capable of signing another certificate). The CA certificate is used to resign the certificates end users see.

Generally CA signing certificates are pretty expensive and require deeper validation. I guess that's why Fortinet provide a signing certificate for each Fortigate.

If you have a look at the Fortinet_CA_SSL cert details you will see it has "CA:TRUE". That's what you need for your own certificate.

If you are concerned about cost- it is probably still cheaper to push out the Fortigate cert than to buy your own CA Cert.

If you have a Windows domain then the certificate can be pushed out via group policy I believe. If you have a domain you may also be able to create your own certificate using the windows server certificate authority in that case.

For smaller business without domains there are are solutiions- for example Microsoft Endpoint Manager allow you to manage device compliance and push out certificates to devices.

Hope that helps.

Andy.

[TecnetRuss]

If you are looking to buy a "CA" certificate from a trusted vendor like Comodo or Digicert that will already be automatically trusted by your client devices like other Comodo or Digitcert-issues certificates and that your FortiGate can use for DPI, then no, this is not possible.  3rd party SSL vendors do not sell "CA" certs.  This would be dangerous as it would allow almost anyone to act as a trusted CA and issue spoofed certificates that anyone would trust.

As Andy suggests, if you have your own internal CA you can issue yourself one and import that into your FortiGate.  If your devices already trust your CA then they'll trust DPI certificates issued by your FortiGate.  But I find it's just as easy to export the built-in FortiGate CA certificate and distribute it to all my domain-joined devices via GPO.

Russ

[mbence84]

And then you have this which is confusing, the third option?

https://kb.fortinet.com/kb/documentLink.do?externalID=FD37095

[mbence84]

Appreciate the feedback. However what is still not clear is there is no way i can install a CA cert that is already trusted by browsers, or some sub CA cert signed by a trusted public CA so that there is no need to import any certs into users cert stores. This is surely not possible I just need confirmation that this is the only way this works, the user needs to install a cert. The reason behind this question is we need to provide a solution to a large college, but need visibility into self harm and suicidal searches or sites that gets accessed. Fortigate has a predefined group called explicit violence which addressed some of this but we need some deeper insight into search engines to get notified on certain key word been searched for. This environment is obviously BYOD and therefore the process of installing certs will be a cumbersome. 

[mbence84]

Thanks for the feedback. So the only option is Forti Authenticator with self enrollment for BYOD?

[sw2090]

De Facto deep inspection requries a CA or a Subordinte CA to wirk since it works as "man-in-the-middle". It needs to decrypt the orignal traffic to be able to filter it and then re-crypt it to send it to the client. For the last part you need a CA or Sub-CA.

Unfortunately yes - there is currently no trusted or/and commercial CA that will sell you a sub-ca or ca or intermediate (which is rather the same) at all or for an affordable price.

We therefore set up our own internal ca that can sign a csr for sub ca to use for deep insepction. The CA to validate this is deployed to all clients in our AD via AD GPO.

[itchubbarabia]

hi dears,

I think I have a very close case and really, I stuck with thinking much about how to figure out the matters.

so, I have a datacenter firewall "FortiGate" which is inspecting traffic between client and Mail server. SMTP traffic is using public certificate "bought thru comodossl" and configured on mail server. so, now I got a huge logs on FortiGate regarding ssl inspection and we figure out that issue with certificate inspection so now really want to decide where to use the public certificate for the inspection in this case should be mounted as local CA certificate on FortiGate or to disable "Server certificate SNI check"

what's your suggestion??