Fortinet white logo
Fortinet white logo

User Guide

Configuring an SSL/SSH inspection profile

Configuring an SSL/SSH inspection profile

To configure an SSL/SSH inspection profile:
  1. Go to Security > Firewall Objects.

  2. Select SSL/SSH Inspection from the Security Profiles dropdown.

  3. Click Create or select an existing profile from the list and click Edit.

  4. In the form, enter the following information:

    Settings

    Guidelines

    Name

    Required. Enter a name for the profile.

    Comments

    Optionally, enter comments.

    SSL Inspection Options

    Enable SSL Inspection of

    Select one of the options and configure the following settings:

    Multiple Clients Connecting to Multiple Servers

    Settings

    Guidelines

    Inspection Method

    Select the method to use for inspection:

    • SSL Certificate Inspection

    • Full SSL Inspection

    CA Certificate

    Select the certificate to use.

    Blocked Certificate

    Allow or Block known malicious certificates.

    Untrusted SSL Certificates

    Select the action to take when a server certificate is not issued by a trusted CA.

    • Allow

    • Block

    • Ignore

    Ignore is only available if Full SSL Inspection is selected.

    Server Certificate SNI Check

    Check the SNI in the hellp message with the CN or SAN field in the returned server certificate.

    • Enable: If mismatched, use the CN in the server certificate to do URL filtering.

    • Strict: If mismatched, close the connection.

    • Disable: Server certificate SNI check is disabled.

    Enforce SSL Cipher Compliance

    Enable or disable enforcement of SSL cipher compliance.

    This option is only available if Full SSL Inspection is selected.

    Enforce SSL Negotiation Compliance

    Enable of disable enforcement of SSL negotiation compliance.

    This option is only available if Full SSL Inspection is selected.

    RPC over HTTPS

    Enable or disable allowing remote procedure calls (RPC) over HTTPS. This protocol is used by Microsoft Exchange Servers to perform virus scanning on emails that use RPC over HTTP.

    This option is only available if Full SSL Inspection is selected.

    Protocol Port Mapping

    For each protocol, enable or disable inspection and specify the port.

    Inspect All Ports

    Enable or disable inspection of all ports.

    Exempt from SSL Inspection

    Reputable Websites

    Enable or disable exempting reputable websites from SSL inspection. This allowlist includes common web sites trusted by FortiGuard.

    This option is only available if Full SSL Inspection is selected.

    Web Categories

    Select categories of websites to exempt from SSL inspection.

    This option is only available if Full SSL Inspection is selected.

    Addresses

    Select previously defined address to exempt from SSL inspection. For more information about adding addresses, see To configure an address.

    This option is only available if Full SSL Inspection is selected.

    Log SSL Exemptions

    This option is only available if Full SSL Inspection is selected.

    SSH Inspection Options

    SSH Deep Scan

    Enable or disable SSH deep scanning, then specify the SSH port.

    Common Options

    Invalid SSL Certificates

    Select whether to Allow or Block all invalid SSL certificates, or select Custom to configure handling for each type of invalid certificate.

    Expired Certificates

    Select the action to take when the certificate is expired.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Revoked Certificates

    Select the action to take when the certificate is revoked.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Validation Timed-Out Certificates

    Select the action to take when the certificate validation times out.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Validation Failed Certificates

    Select the action to take when the certificate validation fails.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Log SSL Anomalies

    Enable or disable logging of SSL anomalies.

    Protecting SSL Server

    Settings

    Guidelines

    Server Certificate

    Select the certificate to use.

    Protocol Port Mapping

    For each protocol, enable or disable inspection and specify the port.

    Inspect All Ports

    Enable or disable inspection of all ports.

    Exempt from SSL Inspection

    Addresses

    Select previously defined address to exempt from SSL inspection. For more information about adding addresses, see To configure an address.

    This option is only available if Full SSL Inspection is selected.

    Log SSL Exemptions

    This option is only available if Full SSL Inspection is selected.

  5. lClick Save to save the profile.

Configuring an SSL/SSH inspection profile

Configuring an SSL/SSH inspection profile

To configure an SSL/SSH inspection profile:
  1. Go to Security > Firewall Objects.

  2. Select SSL/SSH Inspection from the Security Profiles dropdown.

  3. Click Create or select an existing profile from the list and click Edit.

  4. In the form, enter the following information:

    Settings

    Guidelines

    Name

    Required. Enter a name for the profile.

    Comments

    Optionally, enter comments.

    SSL Inspection Options

    Enable SSL Inspection of

    Select one of the options and configure the following settings:

    Multiple Clients Connecting to Multiple Servers

    Settings

    Guidelines

    Inspection Method

    Select the method to use for inspection:

    • SSL Certificate Inspection

    • Full SSL Inspection

    CA Certificate

    Select the certificate to use.

    Blocked Certificate

    Allow or Block known malicious certificates.

    Untrusted SSL Certificates

    Select the action to take when a server certificate is not issued by a trusted CA.

    • Allow

    • Block

    • Ignore

    Ignore is only available if Full SSL Inspection is selected.

    Server Certificate SNI Check

    Check the SNI in the hellp message with the CN or SAN field in the returned server certificate.

    • Enable: If mismatched, use the CN in the server certificate to do URL filtering.

    • Strict: If mismatched, close the connection.

    • Disable: Server certificate SNI check is disabled.

    Enforce SSL Cipher Compliance

    Enable or disable enforcement of SSL cipher compliance.

    This option is only available if Full SSL Inspection is selected.

    Enforce SSL Negotiation Compliance

    Enable of disable enforcement of SSL negotiation compliance.

    This option is only available if Full SSL Inspection is selected.

    RPC over HTTPS

    Enable or disable allowing remote procedure calls (RPC) over HTTPS. This protocol is used by Microsoft Exchange Servers to perform virus scanning on emails that use RPC over HTTP.

    This option is only available if Full SSL Inspection is selected.

    Protocol Port Mapping

    For each protocol, enable or disable inspection and specify the port.

    Inspect All Ports

    Enable or disable inspection of all ports.

    Exempt from SSL Inspection

    Reputable Websites

    Enable or disable exempting reputable websites from SSL inspection. This allowlist includes common web sites trusted by FortiGuard.

    This option is only available if Full SSL Inspection is selected.

    Web Categories

    Select categories of websites to exempt from SSL inspection.

    This option is only available if Full SSL Inspection is selected.

    Addresses

    Select previously defined address to exempt from SSL inspection. For more information about adding addresses, see To configure an address.

    This option is only available if Full SSL Inspection is selected.

    Log SSL Exemptions

    This option is only available if Full SSL Inspection is selected.

    SSH Inspection Options

    SSH Deep Scan

    Enable or disable SSH deep scanning, then specify the SSH port.

    Common Options

    Invalid SSL Certificates

    Select whether to Allow or Block all invalid SSL certificates, or select Custom to configure handling for each type of invalid certificate.

    Expired Certificates

    Select the action to take when the certificate is expired.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Revoked Certificates

    Select the action to take when the certificate is revoked.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Validation Timed-Out Certificates

    Select the action to take when the certificate validation times out.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Validation Failed Certificates

    Select the action to take when the certificate validation fails.

    This option is only available when Invalid SSL Certificates is set to Custom.

    Log SSL Anomalies

    Enable or disable logging of SSL anomalies.

    Protecting SSL Server

    Settings

    Guidelines

    Server Certificate

    Select the certificate to use.

    Protocol Port Mapping

    For each protocol, enable or disable inspection and specify the port.

    Inspect All Ports

    Enable or disable inspection of all ports.

    Exempt from SSL Inspection

    Addresses

    Select previously defined address to exempt from SSL inspection. For more information about adding addresses, see To configure an address.

    This option is only available if Full SSL Inspection is selected.

    Log SSL Exemptions

    This option is only available if Full SSL Inspection is selected.

  5. lClick Save to save the profile.