Questions around ZTNA setup

[systemgeek]

Trying to understand all of this so I have a few questions around the setup:

1. I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.
2. When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????
3. Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?

[AEK · Accepted solution]

1. I don't understand well the concern
2. "Clients will be presented with this certificate when they connect to the access proxy VIP."
   Ref: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/194961/basic-ztna-configuration
   Since ZTNA is built on TLS, when client connects to ZTNA server (FortiGate), it is presented this "default certificate", whatever the backend server it is connecting to. So as per my understanding, this certificate is between FCT and FGT, not between your browser and the backend HTTPS server.
   For HTTPS access proxy, FGT works as a reverse proxy. So as per my understanding, the certificate presented to the web browser should be the configured "default certificate". Ref: https://docs.fortinet.com/document/fortigate/7.0.0/ztna-architecture/19197/ztna-access-proxy
3. I don't know this one

[systemgeek]

I am just trying to understand which cert to use.  I did see some where that the cert is whats used to encrypt the traffic between the FGT and the client.  This is true for all protocols except SSH.  SSH does its own encryption so the FGT lets the traffic run in clear text.  Meaning the ssh encrypted traffic is not encrypted a second time.