Using OpenSSL to generate a CA cert for SSL DPI use

[PaulM1114]

Has anyone used OpenSSL to generate a CA signing certificate for use with the FortiGate to do HTTPS deep packet inspection instead of using the certificate that comes with the FortiGate?  If so could you provide the syntax?

Thanks,

[Somashekara_Hanumant]

Please find the below commands to create a Certificate using OpenSSL

Commands to Generate CA Certificate and KEY. ======================================= genrsa -des3 -out ca.key 1024 req -new -x509 -days 730 -key ca.key -out ca.crt Commands to Generate Server Certificate and KEY. ========================================= genrsa -des3 -out server.key 1024 req -new -key server.key -out server.csr x509 -req -days 730 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt Commands to Generate Client Certificate and KEY ========================================= genrsa -des3 -out client.key 1024 req -key client.key -new -out client.csr x509 -req -days 730 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 02 -out client.crt

[Somashekara_Hanumant]

Above given Openssl commands generates Root certificate and Server certificate.

For more information, please refer the below KB article

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD33000&sliceId=1...

[PaulM1114]

Thank you for the information.  My understanding is that the FortiGate certificate needs to be able to re-sign a server certificate in order to do SSL deep packet inspection so the users don't get prompted with certificate warnings.  Will your command to 'generate CA Certificate and KEY' do this?

[Bromont_FTNT]

You just need to create the root CA certificate, then create an intermediate CA certificate which will be signed by your root CA cert.

[AtiT]

Hello PaulM1114,

OpenSSL is a very good tool but everything is over CLI and you need to know what you are doing, the parameters etc... Fortinet has a good setp-by-step documment for it.

Personally I preffer XCA like: http://sourceforge.net/projects/xca/

It has graphical user interface. You need to create a CA key and CA certificate. After that all the other certificates will be signed with this CA certificate.

Read the XCA docummentation how to use it. Once you have experience with XCA you will never use other software.