Online Certificate Revocation Checking for SSL MITM Inspection?

[NapaCab]

I see that FortiOS has an option to check for certs w/an ocsp-server (responder) for the VPN certificate, but I cannot for the life of me find anything in the FortiOS 6.x guide to configure it (if it's supported) for SSL MITM decryption.

Does FortiOS support this?

TIA!

[hubertzw]

Hi

yes, search ssl full inspection

https://docs.fortinet.com/document/fortigate/6.0.5/handbook/646647/why-use-ssl-inspection

[NapaCab]

I was looking for an option when using SSL inspection to configure an OSCP responder to check for expired/revoked certs?

[hubertzw]

You don't need deep SSL inspection to do it. Check this doc: https://docs2.fortinet.co...icate-revocation-lists