Configuring an SSL/SSH inspection profile
To configure an SSL/SSH inspection profile:
-
Go to Security > Firewall Objects.
-
Select SSL/SSH Inspection from the Security Profiles dropdown.
-
Click Create or select an existing profile from the list and click Edit.
-
In the form, enter the following information:
Settings
Guidelines
Name
Required. Enter a name for the profile.
Comments
Optionally, enter comments.
SSL Inspection Options
Enable SSL Inspection of
Select one of the options and configure the following settings:
Settings
Guidelines
Inspection Method
Select the method to use for inspection:
SSL Certificate Inspection
Full SSL Inspection
CA Certificate
Select the certificate to use.
Blocked Certificate
Allow or Block known malicious certificates. Untrusted SSL Certificates
Select the action to take when a server certificate is not issued by a trusted CA.
Allow
Block
Ignore
Ignore is only available if Full SSL Inspection is selected.
Server Certificate SNI Check
Check the SNI in the hellp message with the CN or SAN field in the returned server certificate.
Enable: If mismatched, use the CN in the server certificate to do URL filtering.
Strict: If mismatched, close the connection.
Disable: Server certificate SNI check is disabled.
Enforce SSL Cipher Compliance
Enable or disable enforcement of SSL cipher compliance.
This option is only available if Full SSL Inspection is selected.
Enforce SSL Negotiation Compliance
Enable of disable enforcement of SSL negotiation compliance.
This option is only available if Full SSL Inspection is selected.
RPC over HTTPS
Enable or disable allowing remote procedure calls (RPC) over HTTPS. This protocol is used by Microsoft Exchange Servers to perform virus scanning on emails that use RPC over HTTP.
This option is only available if Full SSL Inspection is selected.
Protocol Port Mapping
For each protocol, enable or disable inspection and specify the port.
Inspect All Ports
Enable or disable inspection of all ports.
Exempt from SSL Inspection
Reputable Websites
Enable or disable exempting reputable websites from SSL inspection. This allowlist includes common web sites trusted by FortiGuard.
This option is only available if Full SSL Inspection is selected.
Web Categories
Select categories of websites to exempt from SSL inspection.
This option is only available if Full SSL Inspection is selected.
Addresses
Select previously defined address to exempt from SSL inspection. For more information about adding addresses, see To configure an address.
This option is only available if Full SSL Inspection is selected.
Log SSL Exemptions
This option is only available if Full SSL Inspection is selected.
SSH Inspection Options
SSH Deep Scan
Enable or disable SSH deep scanning, then specify the SSH port.
Common Options
Invalid SSL Certificates
Select whether to Allow or Block all invalid SSL certificates, or select Custom to configure handling for each type of invalid certificate.
Expired Certificates
Select the action to take when the certificate is expired.
This option is only available when Invalid SSL Certificates is set to Custom.
Revoked Certificates
Select the action to take when the certificate is revoked.
This option is only available when Invalid SSL Certificates is set to Custom.
Validation Timed-Out Certificates
Select the action to take when the certificate validation times out.
This option is only available when Invalid SSL Certificates is set to Custom.
Validation Failed Certificates
Select the action to take when the certificate validation fails.
This option is only available when Invalid SSL Certificates is set to Custom.
Log SSL Anomalies
Enable or disable logging of SSL anomalies.
Settings
Guidelines
Server Certificate
Select the certificate to use.
Protocol Port Mapping
For each protocol, enable or disable inspection and specify the port.
Inspect All Ports
Enable or disable inspection of all ports.
Exempt from SSL Inspection
Addresses
Select previously defined address to exempt from SSL inspection. For more information about adding addresses, see To configure an address.
This option is only available if Full SSL Inspection is selected.
Log SSL Exemptions
This option is only available if Full SSL Inspection is selected.
-
lClick Save to save the profile.