Hot!Generate True Self-signed Certificate for SSL Inspection on Fortigate

Author
wafikmaher
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2018/01/06 13:04:31
  • Status: offline
2018/01/10 10:01:29 (permalink) 5.4
0

Generate True Self-signed Certificate for SSL Inspection on Fortigate

The default self-signed certificate Fortinet_CA_Untrusted seems to be an issue, the WAD application debug (attached) shows failure of SSL proxy because of it. I know how to replace it with a CA-Signed certificate, however its preferred to fix the problem without an external CA. All Fortinet documents i came across, that mention self-signed certificates (ex. https://docs.fortinet.com/uploaded/files/1704/fortios_certificate_management.pdf), actually discusses about a private CA signed certificate. Is there any way to add a true self-signed (not CA-signed) certificate, or re-generate the default "Fortinet_CA_Untrusted".
#1

6 Replies Related Threads

    seadave
    Expert Member
    • Total Posts : 318
    • Scores: 48
    • Reward points: 0
    • Joined: 2004/11/03 18:02:09
    • Location: Seattle, WA
    • Status: offline
    Re: Generate True Self-signed Certificate for SSL Inspection on Fortigate 2018/06/04 18:19:01 (permalink)
    0
    Thought I would mention something as we are fighting this right now.  Be very careful about using the latest docs when using openssl to self-sign a cert.  For instance this command:
     

    openssl genrsa –des3 –out fgssl.key 2048
     
    would generate a key using 3DES which is no longer suggested due to it being easier to compromise than it should be.  The current 6.0 documentation (https://docs.fortinet.com/d/fortigate-pdf-handbook-60) suggests:
     
    openssl genrsa -aes256 -out fgtcapriv.key 2048
     
    This creates the AES 256bit private key.  Then you need to generate the cert:
     
    openssl req -new -x509 -days 3650 -extensions v3_ca -key fgtcapriv.key -out fgtca.crt
     
    This creates a v3 CA Cert that is valid for 10 years from the date of creation.  As this cert is marked as a CA, it can be used for SSL/TLS DPI on a Fortigate, as long as you make sure this cert is installed as a Trusted Root CA in every machine/phone that will be attempting to run traffic through that policy.  In Windows you can do this by pushing it out via a group policy.
     
    You cannot buy a CA cert for DPI on a Fortigate.  You need to use the built in one or sign one (self-sign) yourself.
     
    But there is another issue.  When you issue this command, openssl will complain that you need an openssl.cnf file.  Creating this is not for the faint of heart.  This page has lots of good information on doing so:
     
    https://www.phildev.net/ssl/opensslconf.html
     
    Here's the FortiCookbook pages, but they neglect to discuss the openssl.cnf issue.
    http://cookbook.fortinet.com/preventing-certificate-warnings/
     
    We are trying to generated a private key that uses ECDHE256.  We keep ending up with ECDSA256 which isn't what we want.  I'll post all the steps when I figure it out.
     
    The main idea about signing your own cert is security.  Only you will have the private key and it will never have been anywhere else.  I'm not sure if the Fortinet built in SSLProxy certs are unique to each FG, but to be sure you sign your own and you back it up.  Then when you update your Fortigate you can reload it if anything goes wrong.  That saves you the hassle of having to push a new one out. 
     
    That is our current predicament.  We created a v1 CA cert somehow, so now we need to create one that is v3 and redeploy that to all our devices before we move to 5.6 or 6.  Not fun.
     
    If you want to learn about OpenSSL and how it relates to TLS and cert management this is a great resource:
     
    https://www.feistyduck.com/books/openssl-cookbook/
    #2
    emnoc
    Expert Member
    • Total Posts : 5318
    • Scores: 349
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Generate True Self-signed Certificate for SSL Inspection on Fortigate 2018/06/04 18:41:37 (permalink)
    0
    i would  not do this
     

     
    openssl req -new -x509 -days 3650 -extensions v3_ca -key fgtcapriv.key -out fgtca.crt
     
     

     
    I would  sign it with a sha2 algo
     
    openssl req -new -x509 -days 3650 -extensions v3_ca -key fgtcapriv.key -out fgca.crt -sha256
     
     
    And regardless if you  use the selfSign or your own, it's still a selfSign cert. The only difference from yours and the installed one in the FGT, vrs a public known CA is that the latter is installed in all common browsers for the most part. And guess what?,  they are ALL a selfSign certificate
     
    Ken
     
     
     
     

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #3
    Duncan
    New Member
    • Total Posts : 13
    • Scores: 2
    • Reward points: 0
    • Joined: 2018/09/11 20:10:29
    • Status: offline
    Re: Generate True Self-signed Certificate for SSL Inspection on Fortigate 2018/11/11 13:59:45 (permalink)
    0
    emnoc
    And regardless if you  use the selfSign or your own, it's still a selfSign cert. The only difference from yours and the installed one in the FGT, vrs a public known CA is that the latter is installed in all common browsers for the most part. And guess what?,  they are ALL a selfSign certificate

    The point seadave correctly made, was the FortiGate cert isn't self-signed. Fortinet signed it. So we don't know for sure someone didn't steal the private key.
    #4
    emnoc
    Expert Member
    • Total Posts : 5318
    • Scores: 349
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Generate True Self-signed Certificate for SSL Inspection on Fortigate 2018/11/11 19:00:27 (permalink)
    0
    The point seadave correctly made, was the FortiGate cert isn't self-signed

     
    Sorry to say but  your  100% incorrect. Each certificate in a FGT is selfSigned. No other CA has signed it, it's issued  by the  fortigate appliance as a selfSIgned.
     
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number: 583906577 (0x22cdb511)
            Signature Algorithm: sha256WithRSAEncryption
            Issuer: C=US, ST=California, L=Sunnyvale, O=Fortinet, OU=Certificate Authority, CN=FGT80C3911619231/emailAddress=support@fortinet.com
            Validity
                Not Before: Apr 18 02:41:06 2018 GMT
                Not After : Apr 18 02:41:06 2028 GMT
            Subject: C=US, ST=California, L=Sunnyvale, O=Fortinet, OU=Certificate Authority, CN=FGT80C3911619231/emailAddress=support@fortinet.com
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                RSA Public Key: (2048 bit)
                    Modulus (2048 bit):
     
    Now if you want to  re-generate or redo the SelfSigned  cert that okay, but let's not confused what a selfSigned certificate is.
     
    Ken Felix

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #5
    seadave
    Expert Member
    • Total Posts : 318
    • Scores: 48
    • Reward points: 0
    • Joined: 2004/11/03 18:02:09
    • Location: Seattle, WA
    • Status: offline
    Re: Generate True Self-signed Certificate for SSL Inspection on Fortigate 2018/11/12 09:46:42 (permalink)
    0
    emnoc
    The point seadave correctly made, was the FortiGate cert isn't self-signed

     
    Sorry to say but  your  100% incorrect. Each certificate in a FGT is selfSigned. No other CA has signed it, it's issued  by the  fortigate appliance as a selfSIgned.
     
    Certificate:    Data:        Version: 3 (0x2)        Serial Number: 583906577 (0x22cdb511)        Signature Algorithm: sha256WithRSAEncryption        Issuer: C=US, ST=California, L=Sunnyvale, O=Fortinet, OU=Certificate Authority, CN=FGT80C3911619231/emailAddress=support@fortinet.com        Validity            Not Before: Apr 18 02:41:06 2018 GMT            Not After : Apr 18 02:41:06 2028 GMT        Subject: C=US, ST=California, L=Sunnyvale, O=Fortinet, OU=Certificate Authority, CN=FGT80C3911619231/emailAddress=support@fortinet.com        Subject Public Key Info:            Public Key Algorithm: rsaEncryption            RSA Public Key: (2048 bit)                Modulus (2048 bit): Now if you want to  re-generate or redo the SelfSigned  cert that okay, but let's not confused what a selfSigned certificate is. Ken Felix



    I agree.  Sorry didn't word that well.  What I was trying to say is it is preferable to sign your own cert to guarantee that only you have the key, even if the factory cert is unique to your device.  Ken is right that you can use the included ProxySSL_CA cert, but in our case we were using an older version that was no longer supported after multiple FOS upgrades. 
     
    My main point of the post was that the OpenSSL example provided in Fortinet documentation at the time was not correct and to watch out for the syntax.  If you aren't living in OpenSSL on a weekly basis all the switches and flags needed is perplexing to say the least.
     
    You cannot buy a CA cert for DPI on a Fortigate.  You need to use the built in one or sign one (self-sign) yourself.

     
    CAs like Digicert and GoDaddy will only sign/sell identity certificates, not CA certs.  At least that is my understanding.  For DPI to work, you need to either use the included device/self-signed certificate (which is designated as a CA) or generate a new one (marked as a CA) using OpenSSL.
     
    I'm not a PKI expert so if I'm twisting the logic around here, feel free to point that out.
    #6
    emnoc
    Expert Member
    • Total Posts : 5318
    • Scores: 349
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: Generate True Self-signed Certificate for SSL Inspection on Fortigate 2018/11/12 10:31:06 (permalink)
    0

    CAs like Digicert and GoDaddy will only sign/sell identity certificates, not CA certs.  At least that is my understanding.  For DPI to work, you need to either use the included device/self-signed certificate (which is designated as a CA) or generate a new one (marked as a CA) using OpenSSL.
     
    I'm not a PKI expert so if I'm twisting the logic around here, feel free to point that out.

     
    NO you did a good  job explaining  it ;) .  Yeah some ORGs what's to use their own selfSigned-cert which is fair and smart.

    PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
    #7
    Jump to:
    © 2019 APG vNext Commercial Version 5.5