SSL Certificates on Fortigate

[fiona]

Hi All,

I am having a witch of a time with certificates on my Fortigate and I am reaching out to see if anyone can assist. 

My primary issue is that when people connect to my public LAN, they are presented with a certificate signed by the Fortigate. Because many devices do not recognize the Fortinet CA, it prevents the consent page from loading and people have a hard time getting on the WLAN.

I wanted to obtain a custom certificate from an CA - like GoDaddy, but they require domain verification. Obviously, my Fortigate is not a registered domain. So I am really confused as to how, or even if, I can get a CA from a public CA for use with this. Do I need to actually register a domain for my Fortigates so that the CA is actually able to verify it? What if I have 2 Fortigates? Do I have to register two domain names?

Also, just wondering how this works with the WLAN consent which comes up under my WLAN gateway IP anyway, which is a private IP, and not the device hostname?

I guess I am "SSL challenged" here and just wondering how others have this working? 

Thanks,

[lobstercreed]

So a few thoughts from my limited experience with certs and captive portals and such...

[ol]

Nothing is ever going to appear as valid if the redirect page is an IP address.  You would have to have a trusted CA issued with the IP address as a subject and as far as I know this is never done.  So you need to find a way to redirect to a hostname that is valid for your domain first of all.

When you say "domain names" what you really mean is DNS entries.  If you own example.com, you can validate that (one domain name) with GoDaddy and then any hostname that is <anything>.example.com would be something you can get a cert issued for (you *would* have to buy multiple certs that way).  You could also get a wildcard certificate that would cover <anything>.example.com so you don't have to buy multiple, but you'll need to do some research on how to export/import keys with your wildcard cert.  Overall it is considered less secure but is doable and would save money.

I don't have my FortiGate offering a consent page, so I can't speak exactly to this.   I have experience with using a Captive Portal on my Aruba WLC and again the key is to make sure that the redirect is to the hostname of my WLC and not the IP address.  If you can't do that, no amount of cert purchasing is going to help you.  You'll just have to train users to go past the warning page, which is a double-edged sword and you'd probably be better off to turn off the captive portal.

I don't think this applies to you, but if you enable deep inspection on any of your policies you will run into all kinds of certificate issues because the FGT is basically doing a MiTM attack, so you'll need to "trust" the FGT cert via Group Policy or something.  You wouldn't want to do this on a public LAN/WLAN if you don't own/manage the end hosts.[/ol]

Hope that helps.  Maybe someone else has more experience with certs or FortiGate captive portal that can correct what I missed.

[neok]

Hi Fiona, first, if you have a captive portal, which I think is what you mean by WLAN, and it has a private IP, you cannot get an SSL certificate from GoDaddy or similar, as these are delivered to a domain verifiable by them, i.e. that domain has to point/resolve to a public IP. I think for your case the best thing would be to see the possibility, if any, that your portal does not use HTTPS, but only HTTP.

Best regards Gabriel

[isamt]

I'm assuming your company own a domain for the company name.

Let's say your company is called MyCompany and they own the domain Mycompany.com Your Fortigate lets say has a public IP of 1.2.3.4

Then in the management portal for your domain create a host (A) record for the fortigate site.

So lets say, create myfortigate.mycompany.com pointing to IP address 1.2.3.4

Now on the Fortigate, go to System | Certificates

Click Generate

Enter

Certificate name: SSLPortal (or any name you want) Domain Name: myfortigate.mycompany.com Organization unit: Locality: State / province: Country/ Region: Email: Subject Alternate: (Leave blank) Password for private key: (leave blank) Key Type: RSA Key Size: 2048 Bit Enrollment: File

Click OK

An entry for SSLPortal is created Click on SSLPortal (or name you called it) Select Download

Now login to GoDaddy portal and purchase an SSL certificate Setup the certificate and paste in the content of the file you downloaded.

GoDaddy will verify you own the domain and may request you add a TXT record with a specific value to prove you own. Once validation is successful they will email you confirmation that certificate has been issued.

Login to Godaddy and download the certificate. Choose type Other for the download.

Go back to Fortigate and click System | Certificate | Import Click File and Browse to the Godaddy cert file and select (extract all the files from the zip) The certificate is now loaded on the Fortigate.

Load in the Godaddy CA files that are in the downloaded zip file. Click Import CA Certificate Click file and browse to the CA file(s) Click Upload

Fortigate imports them as CA_ files, which you can rename in the cli to give more descriptive names.

Now in your portal select the SSLPortal certificate in place on the default Fortinet one.

And that's the process for adding your GoDaddy cert.