Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Magion
Contributor

Own certificate for web filter in FortiClient possible?

I have a test setup with EMS 6.2.6 and FortiClient 6.0.10. When enabling the web filter in the config, I get a certificate warning on the client pc because of the untrusted certificate used by FortiClient. It's a self signed certificate of the FortiClient itself.

 

Is it possible to select/configure a different certificate (we have an internal pki) for web filter use?

 

I found a few similar topics but they all where about the web filtering using FortiGate. However this is a FortiClient/EMS only setup.

9 REPLIES 9
Kenundrum
Contributor III

Yes you can do this. In the EMS, go to the policy components menu and the CA Certificates section. You can upload a CA Cert that is trusted by the clients. The type of certificate is exactly the same as the one you would create for use with FortiGate SSL inspection- typically a Sub-CA of your internal trusted CA.

In each profile, the system settings tab "Other" section is where you would choose which CA certificate would be sent to the client and used for local web filtering.

CISSP, NSE4

 

CISSP, NSE4
Magion

Oooh, is that what CA certificates is for??   Duh! Totally missed that.

Gonna try it out right now!

Magion

Hmm... nope... not working. The certificate shown in the browser is still the self signed certificate.

Jamie_P
New Contributor

Hi Magion,

 

Did you have any movement on this at all? I have the same issue with wanting to use a trusted certificate / CA. I feel like I've been through the options several times and can't find anything obvious.....

 

Thanks,

 

J.

Magion

Sorry no.

Also, even though I'm currently evaluating EMS, since I don't have a FortiClient license (yet) I cannot contact support for this.

ryan_www
New Contributor III

I ran across this post after experiencing a similar issue on FortiClient 7.2.3 on MacOS.  There is a known bug at the moment for FortiClient 7.2.3 on MacOS where the locally generated web certificate is created, but can't be set to trusted if installed while a non-admin user is logged in.  Support confirmed that it is not possible to use a centrally managed certificate.  Hopefully they can add an option like this as it seems like it could be more reliable to use a centrally managed certificate pushed by MDM.  Seems dangerous to hope that the OS does not un-trust the locally generated certificate.  

gunthest

This is the exact issue I am having. Support told me this is part of their new web filtering system, not that it was a bug.  This is disastrous. Hopefully they get it together and address this. 

Ragman
New Contributor II

We have also run into this bug using FortiClient 7.2.3. Has there been any movement from Fortinet regarding this issue.

ryan_www
New Contributor III

Last month, support told me it was being actively investigated as a bug and there was no workaround.  I think it is bug 950099 in these release notes.  https://docs.fortinet.com/document/forticlient/7.2.3/macos-release-notes/124818/known-issues

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors