Hot!Public Signed SSL certificate for SSL deep inspection

Author
mbence84
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/11 13:01:08
  • Status: offline
2020/09/22 13:45:46 (permalink)
0

Public Signed SSL certificate for SSL deep inspection

Can this be done, public Signed SSL certificate for SSL deep inspection on foritgate . Is this possible so that there is no import needed on client devices.
#1

6 Replies Related Threads

    Andy Bailey
    Silver Member
    • Total Posts : 91
    • Scores: 14
    • Reward points: 0
    • Joined: 2016/06/27 11:21:22
    • Status: offline
    Re: Public Signed SSL certificate for SSL deep inspection 2020/09/22 14:21:29 (permalink)
    0
    Hi mbecne84,
     
    Yes, you can use your own certificate- but it needs to be a CA (Certificate Authority) certificate (ie one that is capable of signing another certificate). The CA certificate is used to resign the certificates end users see.
     
    Generally CA signing certificates are pretty expensive and require deeper validation. I guess that's why Fortinet provide a signing certificate for each Fortigate.
     
    If you have a look at the Fortinet_CA_SSL cert details you will see it has "CA:TRUE". That's what you need for your own certificate.
     
    If you are concerned about cost- it is probably still cheaper to push out the Fortigate cert than to buy your own CA Cert.
     
    If you have a Windows domain then the certificate can be pushed out via group policy I believe. If you have a domain you may also be able to create your own certificate using the windows server certificate authority in that case.
     
    For smaller business without domains there are are solutiions- for example Microsoft Endpoint Manager allow you to manage device compliance and push out certificates to devices.
     
    Hope that helps.
     
     
    Andy.
     
     
     
     
     
     
    #2
    TecnetRuss
    Bronze Member
    • Total Posts : 40
    • Scores: 12
    • Reward points: 0
    • Joined: 2017/02/27 13:14:44
    • Status: offline
    Re: Public Signed SSL certificate for SSL deep inspection 2020/09/22 14:33:17 (permalink)
    0
    If you are looking to buy a "CA" certificate from a trusted vendor like Comodo or Digicert that will already be automatically trusted by your client devices like other Comodo or Digitcert-issues certificates and that your FortiGate can use for DPI, then no, this is not possible.  3rd party SSL vendors do not sell "CA" certs.  This would be dangerous as it would allow almost anyone to act as a trusted CA and issue spoofed certificates that anyone would trust.
     
    As Andy suggests, if you have your own internal CA you can issue yourself one and import that into your FortiGate.  If your devices already trust your CA then they'll trust DPI certificates issued by your FortiGate.  But I find it's just as easy to export the built-in FortiGate CA certificate and distribute it to all my domain-joined devices via GPO.
     
    Russ
    #3
    mbence84
    New Member
    • Total Posts : 8
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/11 13:01:08
    • Status: offline
    Re: Public Signed SSL certificate for SSL deep inspection 2020/09/22 14:42:26 (permalink)
    0
    Appreciate the feedback. However what is still not clear is there is no way i can install a CA cert that is already trusted by browsers, or some sub CA cert signed by a trusted public CA so that there is no need to import any certs into users cert stores. This is surely not possible I just need confirmation that this is the only way this works, the user needs to install a cert. The reason behind this question is we need to provide a solution to a large college, but need visibility into self harm and suicidal searches or sites that gets accessed. Fortigate has a predefined group called explicit violence which addressed some of this but we need some deeper insight into search engines to get notified on certain key word been searched for. This environment is obviously BYOD and therefore the process of installing certs will be a cumbersome. 
    #4
    mbence84
    New Member
    • Total Posts : 8
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/11 13:01:08
    • Status: offline
    Re: Public Signed SSL certificate for SSL deep inspection 2020/09/22 14:46:23 (permalink)
    0
    Thanks for the feedback. So the only option is Forti Authenticator with self enrollment for BYOD?
    #5
    mbence84
    New Member
    • Total Posts : 8
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/07/11 13:01:08
    • Status: offline
    Re: Public Signed SSL certificate for SSL deep inspection 2020/09/22 15:22:45 (permalink)
    0
    And then you have this which is confusing, the third option?
     
    https://kb.fortinet.com/kb/documentLink.do?externalID=FD37095
     
    #6
    sw2090
    Expert Member
    • Total Posts : 783
    • Scores: 58
    • Reward points: 0
    • Joined: 2017/06/14 01:27:25
    • Location: Regensburg
    • Status: offline
    Re: Public Signed SSL certificate for SSL deep inspection 2020/09/25 00:33:48 (permalink)
    0
    De Facto deep inspection requries a CA or a Subordinte CA to wirk since it works as "man-in-the-middle". It needs to decrypt the orignal traffic to be able to filter it and then re-crypt it to send it to the client. For the last part you need a CA or Sub-CA.
     
    Unfortunately yes - there is currently no trusted or/and commercial CA that will sell you a sub-ca or ca or intermediate (which is rather the same) at all or for an affordable price.
     
    We therefore set up our own internal ca that can sign a csr for sub ca to use for deep insepction. The CA to validate this is deployed to all clients in our AD via AD GPO.
     
     
    #7
    Jump to:
    © 2020 APG vNext Commercial Version 5.5