Question about Deep Inpection and Certificate problem with WebEx

[chrbar]

Hello,

We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.

We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.

We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features).

But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site".

Do  you know how to avoid this pop-up?

Regards, Chris

[hmtay_FTNT]

Hello Chris,

SSL deep-inspection unfortunately only works for WebEx when accessed from the browser - harder to do certificate pinning on browsers than on native applications. On the native applications, they employ certificate pinning and hence you got the error when deep-inspection is enabled. They do not accept any certificates but their own. To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile. 

HoMing

[chrbar]

hmtay wrote:

To get around this while maintaining deep-inspection, you can set an exemption in the SSL profile.

Thanks HoMing for this good explaination.

In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.

Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

Regards,

Chris

[hmtay_FTNT · Accepted solution]

Hi Chris,

>>In our case, we use deep-inspection specificly for WebEx to be able to filter the different Applications included in WebEx (Desktop.Sharing, Download, Upload, Sharing, Remote.Control, WhiteBoard...) and deny some of them.   Thus we can't set an exemption for "*.webex.com" in the SSL profile, if not we'll lost the Application Filter?

Yes, if you are doing deep-inspection specifically for WebEx only, then exempting it in the SSL profile would defeat the purpose. Unfortunately, there is not much we could do here to make the native application accept any SSL Certificates but their own.

HoMing