Configuring a secure explicit proxy

This information is also available in the FortiOS 7.4 Administration Guide: Secure explicit proxy

Secure explicit web proxy with HTTPS connections is supported between web clients and the FortiGate.

config web-proxy explicit
    set secure-web-proxy {disable | enable | secure}
    set secure-web-proxy-cert <certificate1> <certificate2> ...
    set ssl-dh-bits {768 | 1024 | 1536 | 2048}
end

secure-web-proxy {disable | enable | secure}	Enable/disable/require the secure web proxy for HTTP and HTTPS session. disable: disable secure web proxy (default) enable: enable secure web proxy access, allowing both HTTPS and HTTP connections to the explicit proxy secure: require secure web proxy access, allowing only HTTPS connections to the explicit proxy
secure-web-proxy-cert <certificate1> <certificate2> ...	Enter the names of the server certificates in the local certificate store of the FortiGate used to establish a TLS connection between the user’s browser and the FortiGate. Multiple server certificates can be configured, and different certificate types can be used. The SNI tries to match the right server certificate for the connection. If the SNI cannot not match with the certificates' CN or SAN, the first server certificate will be offered.
ssl-dh-bits {768 | 1024 | 1536 | 2048}	Set the bit size of Diffie-Hellman (DH) prime used in the DHE-RSA negotiation. 768: use 768-bit Diffie-Hellman prime 1024: use 1024-bit Diffie-Hellman prime 1536: use 1536-bit Diffie-Hellman prime 2048: use 2048-bit Diffie-Hellman prime (default)

Example

In this example, a Windows PC user configures an HTTPS URL (https://cp.myqalab.local) as the proxy address for the explicit web proxy. When the user opens a browser (such as Edge or Chrome), the browser will use the HTTPS URL to connect to the explicit web proxy and send any HTTP requests to the proxy over HTTPS. The certificate (server_cert) contains the explicit web proxy's name (cp.myqalab.local) as its CN, so the browser will accept this certificate for the TLS connection.

To configure the Windows proxy settings:

1. On the Windows PC, go to Settings > Network & Internet > Proxy.

2. In the Manual proxy setup section configure the following:

   1. Enable Use a proxy server.

   2. Set the Address to https://cp.myqalab.local.

   3. Set the Port to 8080.

   4. If needed, enter any addresses to exempt in the text box (use a semicolon to separate entries).

   5. Enable Don't use the proxy server for local (intranet) addresses.

      

3. Click Save.

To configure the secure explicit web proxy:

config web-proxy explicit
    set status enable
    set secure-web-proxy enable
    set ftp-over-http enable
    set socks enable
    set http-incoming-port 8080
    set secure-web-proxy-cert "server_cert"
    set socks-incoming-port 1080
    set ipv6-status enable
    set unknown-http-version best-effort
    set pac-file-server-status enable
    set pac-file-data "function FindProxyForURL(url, host) {
   // testtest
   return \"PROXY 10.1.100.1:8080\";
}
"
    set pac-file-through-https enable
end

To verify the TLS connection:

1. Perform a packet capture of HTTPS traffic between the web client and the web server. Wireshark is used in this example.

2. Locate the exchange between the web client (10.1.100.13) and the explicit web proxy (10.1.100.1:8080):

   

   After the client initiates the TLS connection to the explicit web proxy with a client hello packet, the web proxy is able to respond appropriately with a server hello packet to establish a TLS connection first before any HTTP messages are exchanged, and all HTTP messages will be protected by the TLS connection.