Protecting an SSL server

The Protecting SSL Server option of the SSL/SSH Inspection profile is typically applied to an inbound firewall policy for clients on the internet that access a server behind the FortiGate. FortiGate uses the server certificate of the protected server to simulate the real server, which enables FortiGate to decrypt and inspect traffic destined to the real server. Therefore, a valid server certificate must be installed on the FortiGate to enable traffic inspection.

To upload a server certificate into FortiGate and use that certificate in the SSL/SSH inspection profile:

1. Go to System > Certificates.
2. Select Import > Local Certificate and upload the certificate.
3. Go to Security Profiles > SSL/SSH Inspection and edit or create a new profile.
4. For Enable SSL Inspection of, select Protecting SSL Server.
5. For Server Certificate, click the + and select the local certificate you imported.

   

6. Click OK.

When you apply the Protecting SSL Server profile in a policy, the FortiGate will send the server certificate to the client as your server does.