Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiWeb 6.3.4 Administration Guide
    6.3.4
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.10
    7.0.9
    7.0.8
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.2
    6.4.1
    6.4.0
    6.3.23
    6.3.19
    6.3.18
    6.3.17
    6.3.16
    6.3.15
    6.3.14
    6.3.13
    6.3.11
    6.3.10
    6.3.9
    6.3.7
    6.3.6
    6.3.5
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.2
    6.1.1
    5.7.0
    5.6.1
    5.6.0
    5.6.0

    Seamless PKI integration

    Seamless PKI integration

    Seamless PKI integration allows you to configure FortiWeb to verify client certificates and resign a new certificate that is sent to the server for client requests. You can configure a PKI environment in FortiWeb without changing the network or application.

    This feature is used for servers that authenticate users' priorities according to each user's client certificate. When seamless PKI integration is configured, FortiWeb attempts to verify client certificates when users make requests. If FortiWeb successfully verifies the client certificate, it uses the client certificate's subject name and extensions to create a client certificate proxy and resign a new certificate that it then uses to connect to the server. If FortiWeb cannot successfully verify the client certificate, the connection will be closed and an attack log will be generated.

    Seamless PKI integration is available when FortiWeb is in Reverse Proxy and True Transparent Proxy mode.

    tooltip icon

    For the client certificate proxy process to work, Certificate Verification or Enable Server name Indication (SNI) needs to be configured in a server policy. For details, see Configuring an HTTP server policy.

    When Client Certificate Proxy is enabled in a server pool rule, if a Client Certificate has also been selected, the Client Certificate will not be used and the Client Certificate Proxy will take effect instead.
    To configure seamless PKI integration in Reverse Proxy Mode
    1. Go to System > Certificates > Sign CA.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the System Configuration category. For details, see Permissions.
    2. For Type, select one of the following:

      3. PKCS12 Certificate

      Upload a Certificate with key file and enter the Password

      Certificate

      Upload a Certificate File, Key File, and enter the Password.
    3. Click OK.
    4. Go to Server Objects > Server > Server Pool.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    5. Modify an existing server pool or create a new one.
      To modify an existing server pool, select it and click Edit.
      To create a new server pool, click Create New.
    6. Enter a Name for the server pool. You will use this name to select the pool in other parts of the configuration. The maximum length is 63 characters.
    7. Select Reverse Proxy for the Type.
    8. If you select Server Balance for Single Server/Server Balance, see Configure these settings: for configuration instructions.
    9. Click OK.
    10. Modify an existing server pool rule or create a one new.
      To modify an existing server pool rule, select it and click Edit.
      Note: You will have to enable SSL if it is not already configured.
      To create a new server pool rule, click Create New.
    11. Enable SSL.
    12. Enable Client Certificate Proxy.
    13. For Client Certificate Proxy Sign CA, select the Sign CA you uploaded in For Type, select one of the following:.
    14. When you are finished configuring the rule, click OK.
    15. Go to Policy > Server Policy.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    16. Modify an existing server policy or create a new one.
      To modify an existing server policy, select it and click Edit.
      Note: You will have to select a value for the HTTPS Service if it is not already configured.
      To create a new server policy, click Create New.
    17. Configure either:

      18. Certificate Verification

      Select the name of a certificate verifier that FortiWeb will use to validate an HTTP client’s personal certificate.

      Enable Server Name Indication (SNI)

      Enable this option and configure these settings:

      • Enable Strict SNI—Optionally, enable so that FortiWeb will ignore the Certificate when it determines which certificate to present on behalf of server pool members.
      • SNI Policy—Select the Server Name Indication (SNI) configuration that determines which certificate FortiWeb presents on behalf of the members of the server pool.

      Note: You cannot enable both Certificate Verification and Enable Server Name Indication (SNI).

    18. For Server Pool, select the server pool that you modified or created in Modify an existing server pool rule or create a one new.To modify an existing server pool rule, select it and click Edit.Note: You will have to enable SSL if it is not already configured.To create a new server pool rule, click Create New..
    19. Click OK.
    To configure seamless PKI integration in True Transparent Proxy mode
    1. Go to System > Certificates > Sign CA.

      2. To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the System Configuration category. For details, see Permissions.

    2. For Type, select either:

      3. PKCS12 Certificate

      Upload a Certificate with key file and enter the Password

      Certificate

      Upload a Certificate File, Key File, and enter the Password.
    3. Click OK.
    4. Go to Server Objects > Server > Server Pool.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    5. Modify an existing server pool or create a new one.
      To modify an existing server pool, select it and click Edit.
      To create a new server pool, click Create New.
    6. Enter a Name for the server pool. You will use this name to select the pool in other parts of the configuration. The maximum length is 63 characters.
    7. Select True Transparent Proxy for the Type.
    8. Click OK.
    9. Modify an existing server pool rule or create a one new.
      To modify an existing server pool rule, select it and click Edit.
      Note: You will have to enable SSL if it is not already configured.
      To create a new server pool rule, click Create New.
    10. Enable SSL.
    11. Click Show advanced SSL settings.
    12. Enable Client Certificate Proxy.
    13. For Client Certificate Proxy Sign CA, select the Sign CA you uploaded in For Type, select either:.
    14. Configure either:

      15. Certificate Verification

      Select the name of a certificate verifier that FortiWeb will use to validate an HTTP client’s personal certificate.

      Enable Server Name Indication (SNI)

      Enable this option and configure these settings:

      • Enable Strict SNI—Optionally, enable so that FortiWeb will ignore the Certificate when it determines which certificate to present on behalf of server pool members.
      • SNI Policy—Select the Server Name Indication (SNI) configuration that determines which certificate FortiWeb presents on behalf of the members of the server pool.

      Note: You cannot enable both Certificate Verification and Enable Server Name Indication (SNI).

    15. Go to Policy > Server Policy.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    16. Modify an existing server policy or create a new one.
    17. For Server Pool, select the server pool that you modified or created in Modify an existing server pool rule or create a one new.To modify an existing server pool rule, select it and click Edit.Note: You will have to enable SSL if it is not already configured.To create a new server pool rule, click Create New..
      To modify an existing server policy, select it and click Edit.
      To create a new server policy, click Create New.
    18. Click OK.
    See also
    Previous
    Next

    Seamless PKI integration

    Seamless PKI integration

    Seamless PKI integration allows you to configure FortiWeb to verify client certificates and resign a new certificate that is sent to the server for client requests. You can configure a PKI environment in FortiWeb without changing the network or application.

    This feature is used for servers that authenticate users' priorities according to each user's client certificate. When seamless PKI integration is configured, FortiWeb attempts to verify client certificates when users make requests. If FortiWeb successfully verifies the client certificate, it uses the client certificate's subject name and extensions to create a client certificate proxy and resign a new certificate that it then uses to connect to the server. If FortiWeb cannot successfully verify the client certificate, the connection will be closed and an attack log will be generated.

    Seamless PKI integration is available when FortiWeb is in Reverse Proxy and True Transparent Proxy mode.

    tooltip icon

    For the client certificate proxy process to work, Certificate Verification or Enable Server name Indication (SNI) needs to be configured in a server policy. For details, see Configuring an HTTP server policy.

    When Client Certificate Proxy is enabled in a server pool rule, if a Client Certificate has also been selected, the Client Certificate will not be used and the Client Certificate Proxy will take effect instead.
    To configure seamless PKI integration in Reverse Proxy Mode
    1. Go to System > Certificates > Sign CA.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the System Configuration category. For details, see Permissions.
    2. For Type, select one of the following:

      3. PKCS12 Certificate

      Upload a Certificate with key file and enter the Password

      Certificate

      Upload a Certificate File, Key File, and enter the Password.
    3. Click OK.
    4. Go to Server Objects > Server > Server Pool.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    5. Modify an existing server pool or create a new one.
      To modify an existing server pool, select it and click Edit.
      To create a new server pool, click Create New.
    6. Enter a Name for the server pool. You will use this name to select the pool in other parts of the configuration. The maximum length is 63 characters.
    7. Select Reverse Proxy for the Type.
    8. If you select Server Balance for Single Server/Server Balance, see Configure these settings: for configuration instructions.
    9. Click OK.
    10. Modify an existing server pool rule or create a one new.
      To modify an existing server pool rule, select it and click Edit.
      Note: You will have to enable SSL if it is not already configured.
      To create a new server pool rule, click Create New.
    11. Enable SSL.
    12. Enable Client Certificate Proxy.
    13. For Client Certificate Proxy Sign CA, select the Sign CA you uploaded in For Type, select one of the following:.
    14. When you are finished configuring the rule, click OK.
    15. Go to Policy > Server Policy.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    16. Modify an existing server policy or create a new one.
      To modify an existing server policy, select it and click Edit.
      Note: You will have to select a value for the HTTPS Service if it is not already configured.
      To create a new server policy, click Create New.
    17. Configure either:

      18. Certificate Verification

      Select the name of a certificate verifier that FortiWeb will use to validate an HTTP client’s personal certificate.

      Enable Server Name Indication (SNI)

      Enable this option and configure these settings:

      • Enable Strict SNI—Optionally, enable so that FortiWeb will ignore the Certificate when it determines which certificate to present on behalf of server pool members.
      • SNI Policy—Select the Server Name Indication (SNI) configuration that determines which certificate FortiWeb presents on behalf of the members of the server pool.

      Note: You cannot enable both Certificate Verification and Enable Server Name Indication (SNI).

    18. For Server Pool, select the server pool that you modified or created in Modify an existing server pool rule or create a one new.To modify an existing server pool rule, select it and click Edit.Note: You will have to enable SSL if it is not already configured.To create a new server pool rule, click Create New..
    19. Click OK.
    To configure seamless PKI integration in True Transparent Proxy mode
    1. Go to System > Certificates > Sign CA.

      2. To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the System Configuration category. For details, see Permissions.

    2. For Type, select either:

      3. PKCS12 Certificate

      Upload a Certificate with key file and enter the Password

      Certificate

      Upload a Certificate File, Key File, and enter the Password.
    3. Click OK.
    4. Go to Server Objects > Server > Server Pool.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    5. Modify an existing server pool or create a new one.
      To modify an existing server pool, select it and click Edit.
      To create a new server pool, click Create New.
    6. Enter a Name for the server pool. You will use this name to select the pool in other parts of the configuration. The maximum length is 63 characters.
    7. Select True Transparent Proxy for the Type.
    8. Click OK.
    9. Modify an existing server pool rule or create a one new.
      To modify an existing server pool rule, select it and click Edit.
      Note: You will have to enable SSL if it is not already configured.
      To create a new server pool rule, click Create New.
    10. Enable SSL.
    11. Click Show advanced SSL settings.
    12. Enable Client Certificate Proxy.
    13. For Client Certificate Proxy Sign CA, select the Sign CA you uploaded in For Type, select either:.
    14. Configure either:

      15. Certificate Verification

      Select the name of a certificate verifier that FortiWeb will use to validate an HTTP client’s personal certificate.

      Enable Server Name Indication (SNI)

      Enable this option and configure these settings:

      • Enable Strict SNI—Optionally, enable so that FortiWeb will ignore the Certificate when it determines which certificate to present on behalf of server pool members.
      • SNI Policy—Select the Server Name Indication (SNI) configuration that determines which certificate FortiWeb presents on behalf of the members of the server pool.

      Note: You cannot enable both Certificate Verification and Enable Server Name Indication (SNI).

    15. Go to Policy > Server Policy.
      To access this part of the web UI, your administrator account’s access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
    16. Modify an existing server policy or create a new one.
    17. For Server Pool, select the server pool that you modified or created in Modify an existing server pool rule or create a one new.To modify an existing server pool rule, select it and click Edit.Note: You will have to enable SSL if it is not already configured.To create a new server pool rule, click Create New..
      To modify an existing server policy, select it and click Edit.
      To create a new server policy, click Create New.
    18. Click OK.
    See also
    Previous
    Next