SSL Intercept Breaking Skype

[MikePruett]

You guys have any experience with SSL Intercept breaking Skype? I have been testing it on my home computer with my FortiWIFI 60D and it seems that skype dies when I enable SSL Intercept.

Please advise

[Christopher_McMullan]

Skype has the certificate it expects to be presented from the application servers built into the software. When deep inspection is imposed, and the FortiGate re-writes the server certificate signed on its own authority in order to impersonate the server and decrypt the client traffic, it causes the certificate to fail the client's check, and further traffic will not proceed.

Unfortunately, since the client does not have a web browser interface, it is harder to notify end users exactly why their login attempt failed, whether due to deep inspection breaking otherwise allowed traffic, or else when traffic is actually denied by policy: the user just sees it as a timeout issue.

[MikePruett]

Christopher McMullan_FTNT wrote:

Skype has the certificate it expects to be presented from the application servers built into the software. When deep inspection is imposed, and the FortiGate re-writes the server certificate signed on its own authority in order to impersonate the server and decrypt the client traffic, it causes the certificate to fail the client's check, and further traffic will not proceed.

Unfortunately, since the client does not have a web browser interface, it is harder to notify end users exactly why their login attempt failed, whether due to deep inspection breaking otherwise allowed traffic, or else when traffic is actually denied by policy: the user just sees it as a timeout issue.

I suppose the best thing to do then would be to make a policy to allow skype out and place it above the SSL Intercept policy

[Christopher_McMullan]

With apps, it's tricky:

-You can't reliably use FQDN address objects to define firewall policy destinations when the name can resolve to more than 32 IP addresses

-There may not be a traditional certificate exchange which would allow the FortiGate to at least review the CN or SNI fields for the server hostname the client is contacting

In OS 5.2, you can use an FQDN address object specifically when defining destinations to exempt from deep inspection - this may work. If the servers contacted are at least known to fall under Skype's FortiGuard categories, you could exempt the category, although obviously the FQDN exemption would be much more surgically precise.