AnsweredHot!Certificate inspection: untrusted certificate warning broken (5.4.5)

Author
Zac67
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/04 00:28:47
  • Status: offline
2017/08/04 01:04:01 (permalink) 5.4
0

Certificate inspection: untrusted certificate warning broken (5.4.5)

When you've activated certificate inspection or deep SSL inspection, the acceptance of the external certificate is up to the FG. When it rejects the external certificate it the page with the warning:
"This Connection is Untrusted ..."
 
You can check this e.g. on https://self-signed.badssl.com/
 
However, for this page's certificate the FG always uses a certificate signed by the factory "Fortinet Untrusted CA", regardless of what you've set up for HTTPS or SSL inspection.
 
According to support (ticket #2289811), this is not configurable. In my humble opinion, this function is broken since it urges the user to (permanently) accept a root certificate which is present - and extractable - on every Fortigate on the planet, leaving a critical vulnerability for man-in-the-middle attacks.
 
Are there any ways around this? Is this issue addressed in 5.6?
#1
bommi
Silver Member
  • Total Posts : 64
  • Scores: 4
  • Reward points: 0
  • Joined: 2016/08/03 03:42:49
  • Location: Germany
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/08/04 02:58:33 (permalink) ☄ Helpfulby Zac67 2017/08/04 03:36:26
4 (1)
Hi,
 
I just checked this, but I cant change the Untrusted CA Certificate in 5.6.1.
 
Regards
bommi
#2
Zac67
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/04 00:28:47
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/08/04 03:37:22 (permalink)
0
Pity - thanks for the feedback!
#3
dmcquade
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/10/31 06:21:51
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/08/09 14:49:17 (permalink)
0
The problem is you are using the default CA cert on the Fortigate. You could download this and add to your workstations as a trusted CA cert. Although named the same, it is NOT the same cert on all Fortigates.
 
I've implemented this by generating a CSR on the Fortigate and submitted it to the local network PKI to create a CA Cert using an ICA already trusted by the workstations. Import this into the Fortigate and the workstations will not receive the Untrusted Cert message.
#4
rdumitrescu
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/12/02 08:06:13
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/08/10 00:27:52 (permalink) ☼ Best Answerby Zac67 2017/09/08 07:04:39
5 (1)
Hi Zac67,
By default the firewall use an "Untrust CA" for the websites that have broken certificate. (as your example "https://self-signed.badssl.com/")

You can change that from CLI:
config firewall ssl-ssh-profile
edit "--your profile--"
set untrusted-caname "your trusted CA"
end
 
In this way you will avoid the certificate warning. (If you have installed on the PC the "trusted CA")
Still, the best practice says to warning the users when they are going to an "untrust" (faulty certficate) website.
So you should find your best compromise between usability and security.
 
Regards
Radu
#5
Zac67
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/04 00:28:47
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/08/29 00:51:48 (permalink)
0
Thanks for your suggestion, Radu! "Untrusted-caname" was the keyword, now I can also find at least a cursory mention in the manual under Inspection Exemption(!) - support wasn't able to point me there.
 
Setting untrusted-caname to the (working) SSL-inspection-certificate didn't work. Now the warning page can't load any more at all (keeps connecting forever). Even an unset untrusted-caname doesn't fix this. But it's definitely the right track: Certificates in the GUI counts one reference less to the Fortinet untrusted CA cert and one more for ours. I'll investigate further.
post edited by Zac67 - 2017/08/30 01:53:37
#6
FAPM
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/25 09:44:16
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/08/29 13:07:59 (permalink) ☄ Helpfulby Zac67 2017/09/01 01:00:26
0
Hi,
I am in version 5.6.2 and I have the same problem ... 
#7
Zac67
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/04 00:28:47
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/09/08 07:04:21 (permalink)
0
Radu: even though the "Untrusted-caname" option didn't work right away, it did start working at some time later on. I just stumbled on a page with an incomplete certificate chain (intermediate cert missing) and wondered why I could read the FG's warning - checked the certificate and it's ours! THANK YOU!!
#8
rdumitrescu
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/12/02 08:06:13
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/09/08 07:41:08 (permalink)
0
Hi Zac67 glad to hear that you managed to solve the issue.
Just after that you modified the "Untrusted-caname" it may be that your browser has the web server certificate cached, that's why it started to work later.
Cheers
Radu
 
 
#9
Zac67
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/08/04 00:28:47
  • Status: offline
Re: Certificate inspection: untrusted certificate warning broken (5.4.5) 2017/09/08 08:51:24 (permalink)
0
Well, I restarted Firefox (I know that deleting the cache and shift-ctrl-R don't always force a certificate reload or SSL renegotiation) and also tried a second PC - somehow the setting didn't catch right away. Possibly the FG had retained some connection data for a short while, I don't know.
 
We didn't test long, just a few minutes; I guess we should have tested a bit longer.
#10
Jump to:
© 2017 APG vNext Commercial Version 5.5