Fortinet Document Library

Version:


Table of Contents

New Features

7.0.0
Download PDF
Copy Link

Allow deep inspection certificates to be synchronized to EMS and distributed to FortiClient 7.0.1

On FortiClient EMS versions that support push CA certs capability, the FortiGate will push CA certificates used in SSL deep inspection to the EMS server. On the EMS server, the CA certificates can be selected in the managed endpoint profiles so they can be installed on managed endpoints. FortiClient EMS 7.0.1 is required to use this feature.

Example

To configure deep inspection certificate synchronization to EMS:
  1. Configure the EMS Fabric connector:
    config endpoint-control fctems
        edit "ems138"
            set fortinetone-cloud-authentication disable
            set server "172.16.200.138"
            set https-port 443
            set source-ip 0.0.0.0
            set pull-sysinfo enable
            set pull-vulnerabilities enable
            set pull-avatars enable
            set pull-tags enable
            set pull-malware-hash enable
            set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs
            set call-timeout 30
            set websocket-override disable
            set preserve-ssl-session disable
        next
    end
  2. Apply the certificate to an SSL/SSH profile for deep inspection:
    config firewall ssl-ssh-profile
        edit "deep-inspection"
            set comment "Read-only deep inspection profile."
            config https
                set ports 443
                set status deep-inspection
            end
            ...
            set server-cert-mode re-sign
            set caname "Fortinet_CA_SSL"
            set untrusted-caname "Fortinet_CA_Untrusted"
        next
    end

    The default deep inspection profile, CA certificate, and untrusted CA certificates are used in this example.

  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set name "deep-inspection"
            set srcintf "port14"
            set dstintf "port13"
            set action accept
            set srcaddr "all"
            set dstaddr "all"
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set ssl-ssh-profile "deep-inspection"
            set av-profile "default"
            set nat enable
        next
    end
  4. In EMS, verify that the CA certificate was pushed to EMS:
    1. Go to Endpoint Policy & Components > CA Certificates.

    2. Verify the certificate table to see that the EMS server received the CA certification from the different FortiGates.
  5. Select the CA certificate in the endpoint profile:
    1. Go to Endpoint Profiles > Manage Profiles and edit a profile. The default profile is used in this example.
    2. Click Advanced in the top right corner and click the System Settings tab.
    3. In the Other section, enable Install CA Certificate on Client and select the Fortinet_CA_SSL certificate for the desired endpoint.

    4. Click Save.
    5. Once the FortiClient endpoint is registered, it receives the CA certificate. When the FortiClient endpoint tries to access the internet through the FortiGate with the firewall policy that has deep inspection, no warning message is displayed. The server certificate is trusted with the installed CA certificate to complete the certificate chain.

Verification

Before configuring deep inspection certificate synchronization, a warning message is displayed when a FortiClient endpoint accesses the internet through the FortiGate with the firewall policy that has deep inspection. The FortiClient certificate store does not have the FortiGate's CA that is used in the deep inspection SSL/SSH profile.

For example, accessing https://www.facebook.com in Chrome shows a warning. In the address bar, clicking Not secure > Certificate opens the Certificate dialog, which indicates that Windows does not have enough information to verify the certificate.

After the EMS profile is pushed to FortiClient endpoint, the expected FortiGate's certificate is shown in its certificate store.

To verify the deep inspection certificate synchronization:
  1. In Chrome, go to Settings > Privacy and security and open Manage certificates.
  2. Click the Trusted Root Certification Authorities tab. The FortiGate's certificate appears in the list.

  3. On the FortiClient endpoint using Chrome, go to https://www.facebook.com. The website is displayed.
  4. In the address bar, click the padlock, then click Certificate. The dialog displays the valid certificate information.

Diagnostics

Use the diagnose endpoint fctems json deep-inspect-cert-sync command in FortiOS to verify the certificate information. In the following example, there are multiple VDOMs with FortiGates in HA mode.

To verify the primary FortiGate:
FGT_EC_Primary (global) # diagnose endpoint fctems json deep-inspect-cert-sync 
JSON:
"""
{
  "fortigates":[
    "FG2K5E39169*****",
    "FG2K5E39169*****"
  ],
  "vdoms":[
    {
      "vdom":"root",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    },
    {
      "vdom":"vdom1",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    }
  ]
}
"""
To verify the secondary FortiGate:
FGT_EC_Secondary(global) # diagnose endpoint fctems json deep-inspect-cert-sync 
JSON:
"""
{
  "fortigates":[
    "FG2K5E39169*****",
    "FG2K5E39169*****"
  ],
  "vdoms":[
    {
      "vdom":"root",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    },
    {
      "vdom":"vdom1",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    }
  ]
}
"""

Allow deep inspection certificates to be synchronized to EMS and distributed to FortiClient 7.0.1

On FortiClient EMS versions that support push CA certs capability, the FortiGate will push CA certificates used in SSL deep inspection to the EMS server. On the EMS server, the CA certificates can be selected in the managed endpoint profiles so they can be installed on managed endpoints. FortiClient EMS 7.0.1 is required to use this feature.

Example

To configure deep inspection certificate synchronization to EMS:
  1. Configure the EMS Fabric connector:
    config endpoint-control fctems
        edit "ems138"
            set fortinetone-cloud-authentication disable
            set server "172.16.200.138"
            set https-port 443
            set source-ip 0.0.0.0
            set pull-sysinfo enable
            set pull-vulnerabilities enable
            set pull-avatars enable
            set pull-tags enable
            set pull-malware-hash enable
            set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs
            set call-timeout 30
            set websocket-override disable
            set preserve-ssl-session disable
        next
    end
  2. Apply the certificate to an SSL/SSH profile for deep inspection:
    config firewall ssl-ssh-profile
        edit "deep-inspection"
            set comment "Read-only deep inspection profile."
            config https
                set ports 443
                set status deep-inspection
            end
            ...
            set server-cert-mode re-sign
            set caname "Fortinet_CA_SSL"
            set untrusted-caname "Fortinet_CA_Untrusted"
        next
    end

    The default deep inspection profile, CA certificate, and untrusted CA certificates are used in this example.

  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set name "deep-inspection"
            set srcintf "port14"
            set dstintf "port13"
            set action accept
            set srcaddr "all"
            set dstaddr "all"
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set ssl-ssh-profile "deep-inspection"
            set av-profile "default"
            set nat enable
        next
    end
  4. In EMS, verify that the CA certificate was pushed to EMS:
    1. Go to Endpoint Policy & Components > CA Certificates.

    2. Verify the certificate table to see that the EMS server received the CA certification from the different FortiGates.
  5. Select the CA certificate in the endpoint profile:
    1. Go to Endpoint Profiles > Manage Profiles and edit a profile. The default profile is used in this example.
    2. Click Advanced in the top right corner and click the System Settings tab.
    3. In the Other section, enable Install CA Certificate on Client and select the Fortinet_CA_SSL certificate for the desired endpoint.

    4. Click Save.
    5. Once the FortiClient endpoint is registered, it receives the CA certificate. When the FortiClient endpoint tries to access the internet through the FortiGate with the firewall policy that has deep inspection, no warning message is displayed. The server certificate is trusted with the installed CA certificate to complete the certificate chain.

Verification

Before configuring deep inspection certificate synchronization, a warning message is displayed when a FortiClient endpoint accesses the internet through the FortiGate with the firewall policy that has deep inspection. The FortiClient certificate store does not have the FortiGate's CA that is used in the deep inspection SSL/SSH profile.

For example, accessing https://www.facebook.com in Chrome shows a warning. In the address bar, clicking Not secure > Certificate opens the Certificate dialog, which indicates that Windows does not have enough information to verify the certificate.

After the EMS profile is pushed to FortiClient endpoint, the expected FortiGate's certificate is shown in its certificate store.

To verify the deep inspection certificate synchronization:
  1. In Chrome, go to Settings > Privacy and security and open Manage certificates.
  2. Click the Trusted Root Certification Authorities tab. The FortiGate's certificate appears in the list.

  3. On the FortiClient endpoint using Chrome, go to https://www.facebook.com. The website is displayed.
  4. In the address bar, click the padlock, then click Certificate. The dialog displays the valid certificate information.

Diagnostics

Use the diagnose endpoint fctems json deep-inspect-cert-sync command in FortiOS to verify the certificate information. In the following example, there are multiple VDOMs with FortiGates in HA mode.

To verify the primary FortiGate:
FGT_EC_Primary (global) # diagnose endpoint fctems json deep-inspect-cert-sync 
JSON:
"""
{
  "fortigates":[
    "FG2K5E39169*****",
    "FG2K5E39169*****"
  ],
  "vdoms":[
    {
      "vdom":"root",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    },
    {
      "vdom":"vdom1",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    }
  ]
}
"""
To verify the secondary FortiGate:
FGT_EC_Secondary(global) # diagnose endpoint fctems json deep-inspect-cert-sync 
JSON:
"""
{
  "fortigates":[
    "FG2K5E39169*****",
    "FG2K5E39169*****"
  ],
  "vdoms":[
    {
      "vdom":"root",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    },
    {
      "vdom":"vdom1",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    }
  ]
}
"""