Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mbence84
New Contributor

Public Signed SSL certificate for SSL deep inspection

Can this be done, public Signed SSL certificate for SSL deep inspection on foritgate . Is this possible so that there is no import needed on client devices.

8 REPLIES 8
andrewbailey
Contributor II

Hi mbecne84,

 

Yes, you can use your own certificate- but it needs to be a CA (Certificate Authority) certificate (ie one that is capable of signing another certificate). The CA certificate is used to resign the certificates end users see.

 

Generally CA signing certificates are pretty expensive and require deeper validation. I guess that's why Fortinet provide a signing certificate for each Fortigate.

 

If you have a look at the Fortinet_CA_SSL cert details you will see it has "CA:TRUE". That's what you need for your own certificate.

 

If you are concerned about cost- it is probably still cheaper to push out the Fortigate cert than to buy your own CA Cert.

 

If you have a Windows domain then the certificate can be pushed out via group policy I believe. If you have a domain you may also be able to create your own certificate using the windows server certificate authority in that case.

 

For smaller business without domains there are are solutiions- for example Microsoft Endpoint Manager allow you to manage device compliance and push out certificates to devices.

 

Hope that helps.

 

 

Andy.

 

 

 

 

 

 

TecnetRuss

If you are looking to buy a "CA" certificate from a trusted vendor like Comodo or Digicert that will already be automatically trusted by your client devices like other Comodo or Digitcert-issues certificates and that your FortiGate can use for DPI, then no, this is not possible.  3rd party SSL vendors do not sell "CA" certs.  This would be dangerous as it would allow almost anyone to act as a trusted CA and issue spoofed certificates that anyone would trust.

 

As Andy suggests, if you have your own internal CA you can issue yourself one and import that into your FortiGate.  If your devices already trust your CA then they'll trust DPI certificates issued by your FortiGate.  But I find it's just as easy to export the built-in FortiGate CA certificate and distribute it to all my domain-joined devices via GPO.

 

Russ

mbence84

And then you have this which is confusing, the third option?

 

https://kb.fortinet.com/kb/documentLink.do?externalID=FD37095

 

mbence84

Appreciate the feedback. However what is still not clear is there is no way i can install a CA cert that is already trusted by browsers, or some sub CA cert signed by a trusted public CA so that there is no need to import any certs into users cert stores. This is surely not possible I just need confirmation that this is the only way this works, the user needs to install a cert. The reason behind this question is we need to provide a solution to a large college, but need visibility into self harm and suicidal searches or sites that gets accessed. Fortigate has a predefined group called explicit violence which addressed some of this but we need some deeper insight into search engines to get notified on certain key word been searched for. This environment is obviously BYOD and therefore the process of installing certs will be a cumbersome. 

mbence84

Thanks for the feedback. So the only option is Forti Authenticator with self enrollment for BYOD?

sw2090

De Facto deep inspection requries a CA or a Subordinte CA to wirk since it works as "man-in-the-middle". It needs to decrypt the orignal traffic to be able to filter it and then re-crypt it to send it to the client. For the last part you need a CA or Sub-CA.

 

Unfortunately yes - there is currently no trusted or/and commercial CA that will sell you a sub-ca or ca or intermediate (which is rather the same) at all or for an affordable price.

 

We therefore set up our own internal ca that can sign a csr for sub ca to use for deep insepction. The CA to validate this is deployed to all clients in our AD via AD GPO.

 

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Donald_Cooper


@mbence84 wrote:

Appreciate the feedback. However what is still not clear is there is no way i can install a CA cert that is already trusted by browsers, or some sub CA cert signed by a trusted public CA so that there is no need to import any certs into users cert stores. This is surely not possible I just need confirmation that this is the only way this works, the user needs to install a cert. The reason behind this question is we need to provide a solution to a large college, but need visibility into self harm and suicidal searches or sites that gets accessed. Fortigate has a predefined group called explicit violence which addressed some of this but we need some deeper insight into search engines to get notified on certain key word been searched for. This environment is obviously BYOD and therefore the process of installing certs will be a cumbersome. 


You're correct in noting that without installing a certificate into user stores, achieving deep SSL inspection for monitoring encrypted traffic isn't straightforward. The primary challenge here is that browsers and operating systems need to trust the certificate authority (CA) to decrypt and inspect HTTPS traffic.

itchubbarabia
New Contributor II

hi dears,

I think I have a very close case and really, I stuck with thinking much about how to figure out the matters.

so, I have a datacenter firewall "FortiGate" which is inspecting traffic between client and Mail server. SMTP traffic is using public certificate "bought thru comodossl" and configured on mail server. so, now I got a huge logs on FortiGate regarding ssl inspection and we figure out that issue with certificate inspection so now really want to decide where to use the public certificate for the inspection in this case should be mounted as local CA certificate on FortiGate or to disable "Server certificate SNI check"

what's your suggestion??

imigdad
imigdad
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors