Configuring FortiManager to deploy certificates for deep inspection
FortiManager can be used to deploy certificates to FortiGate devices. These certificates can include Certificate Authority (CA) certificates, commonly used for deep inspection.
The steps for deploying a CA certificate for deep inspection are as follows:
Generate a CA certificate on FortiAuthenticator
To generate a CA certificate on FortiAuthenticator:
-
On the FortiAuthenticator, go to Certificate Management > Certificate Authorities > Local CAs, and select +Create New.
-
Specify a Certificate ID, leave the Certificate type as Root CA, and specify a Name (CN).
-
You may provide additional fields as desired.
-
Select OK.
Generate an intermediate CA certificate
To generate an intermediate CA certificate:
-
From Certificate Management > Certificate Authorities > Local CAs, and select +Create New.
-
Provide a name for the certificate as Certificate ID.
-
For Certificate type, select Intermediate CA.
-
Use the dropdown for Certificate authority to select the certificate created in the previous step.
-
For CN, provide a name for the intermediate CA certificate.
-
Click OK to save.
-
Use the checkbox to select the generated intermediate CA certificate, then click Export Key and Cert in the top navigation bar.
-
Provide a passphrase to secure the private key.
-
Select Download PKCS#12 file, then select Finish.
Upload the intermediate CA certificate to FortiManager
To upload the intermediate CA certificate to FortiManager:
-
Navigate to Policy & Objects > Advanced.
-
From the top menu bar, select Tools > Feature Visibility.
-
Under Advanced, enable Dynamic Local Certificate.
-
Select Dynamic Local Certificate from the top.
-
Select +Create New in the top left.
-
Specify a name for the certificate.
-
Expand Per-Device Mapping and select Create New to create a new mapping.
-
Select the target FortiGate for Mapped device.
-
Select Import next to Import Certificate.
-
Select PKCS#12 Certificate for Type.
-
Upload the file by browsing or drag-and-dropping the certificate.
-
Provide the password used to secure the private key.
-
Specify the name for the certificate.
-
Select OK.
If the newly uploaded certificate does not appear in the dropdown for Local Certificate, select OK, then select the mapped device and edit once more.
-
Use the Local Certificate dropdown to select the newly uploaded certificate.
-
Select OK to save the per-device mapping.
-
Provide a change note and select OK to save the dynamic local certificate.
Use the certificate in a policy and install the Policy Package
To update SSL/SSH inspection to use the uploaded certificate:
-
Navigate to Policy & Objects > Security Profiles, and select SSL/SSH Inspection from the top menu.
-
Edit custom-deep-inspection.
-
For CA Certificate, use the dropdown to select the uploaded intermediate CA certificate.
-
Provide a change note and select OK to save.
-
Use this security profile, along with a web filtering profile, in a policy assigned to the FortiGate with the certificate mapping.
-
Install the Policy Package.
For more information, see Deep Inspection in the FortiGate Administration Guide on the Fortinet Document Library, as you need to install this intermediate CA on endpoints/browsers to enable the certificate rewriting to be trusted.
Verify on an endpoint
This guide assumes the certificate used in the deep inspection profile is trusted by the endpoint.
To verify on an endpoint:
-
Navigate to an HTTPS site on an endpoint which would send traffic through the policy you applied the SSL/SSH custom-deep-inspection profile to.
-
When the site loads, inspect the certificate that is being used.
-
Note how the certificate is valid.
-
Note how the Issued By section reflects the certificate you selected for your deep inspection.
-