HTTPS Filtering with Subject Alternative Names SAN

[DanielW]

Hello Community,

I am struggling to find any information on my problem. Are Fortigate Firewalls in any OS able to evaluate the Subject Alternative Name (SAN) information in a certificate?

To give a specific example: We want to monitor access to https://pastebin.com

Since the connection is TLS encrypted we have to rely on certifictae inspection (deep inspection is not an option). I know, the certificate inspection is evaluating the CN field in the presented certificate. Unfortunately, since the website is announced via Cloudflare, the CN for the website is issued for Cloudflare. Just the SAN field of the certificate states pastebin.com as valid alternative name.

At the moment I do not see any possibility to filter or monitor this. Anyone faced a similar situation and has some advice?

Kind regards,

Daniel

[DanielW]

Well, got an official answer:

"Unfortunately the behavior of webfilter is maintained throughout all the FortiOS versions, which means that the webfilter, when using certificate inspection, will look at the CN of the certificate presented by the webpage."

Therefore, my example would pass the webfilter if you do not block Cloudflare in general.

[tanr]

I'm surprised they haven't put in code to look at the SAN in certificate inspection, and that the web filter isn't yet capable of looking at the SAN.  Seems like a that should be a core part of both of these, given current SAN usage.

Have you raised this as a New Feature Request (NFR) with your Fortinet SE?

[emnoc]

I'm sure that is not true in that response. If a Subject AltName is present the CN is overlooked from my experience, you can test that out in a browser and then thru the fortios with web-profile. No modern browser uses the CN btw  and when the AltName is present

Ken Felix

[ktam88_FTNT]

FortiOS WCF also inspects SNI portion of a cert (actually from the client hello) prior to inspecting the server CN cert portion. With this is should address the web filtering of the actual destination the end user is going to.

see https://kb.fortinet.com/kb/documentLink.do?externalID=FD34661