Technical Tip: How to import a FortiGate deep SSL certificate in the system

[mpandya]

Description	This article explains the procedure to import a FortiGate deep SSL certificate.
Scope	FortiGate.
Solution	Importing a FortiGate Deep SSL Inspection certificate into a system involves multiple steps. Deep SSL inspection involves intercepting and decrypting SSL/TLS traffic to inspect its contents for security purposes. Note that these steps can vary based on the specific FortiGate version and the operating system in use. Below is a general outline of the process: Obtain the SSL certificate: Obtain the SSL certificate that the FortiGate unit uses for deep SSL inspection. This could be a self-signed certificate or a certificate signed by the organization's Certificate Authority (CA). Export the SSL certificate: Export the SSL certificate from the FortiGate unit. This can typically be done from the FortiGate's web-based management interface or command-line interface (CLI). Copy the certificate to the system: Transfer the exported SSL certificate and private key to the local system. It is recommended to use secure methods like SFTP, SCP, or a secure file-sharing service. Import the Certificate: On Windows: Open the Windows 'Certificate Manager' (certmgr.msc) service as an administrator. Navigate to the 'Trusted Root Certification Authorities' or 'Personal' store, depending on where the certificate is to be installed. Right-click on the store and choose All Tasks -> Import... Follow the wizard to import the certificate. Make sure to select the option to include the private key if applicable. On macOS: Open the 'Keychain Access' application. Go to the 'File' menu and choose 'Import Items...' Browse to the certificate file exported earlier and import it. Make sure to import it to the appropriate keychain (such as 'login' or 'System'), depending on use case. On Linux: Depending on theLinux distribution and desktop environment, there may be different tools to manage certificates. On GNOME-based desktops, the 'Seahorse' application can be used. Open the certificate manager and import the certificate. Trust the Certificate: It may be necessary to mark the certificate as trusted to ensure that the system trusts the FortiGate SSL certificate for deep SSL inspection. This step can involve moving the certificate to a trusted store or adjusting trust settings. Restart Applications: In some cases, it may be necessary to restart the web browser or other applications that use SSL/TLS to establish connections. This will ensure that they recognize the newly imported certificate. Please note that the specific steps can vary depending on the operating system, FortiGate version, and the organization's security policies. Always follow the organization's guidelines and best practices for certificate management.