SSL inspection CA first then deep inspect

Lessons · FortiGate series · SSL inspection + CA trust

Hero · handshake is not decrypt

Why HTTPS still hides the payload

Accept on LAN-to-WAN only won the 5-tuple. HTTPS is still ciphertext after that. IPS, AV, DLP and most App Control signatures never see the body until SSL/SSH Inspection is Full SSL Inspection. Certificate-inspection is the usual “we turned inspection on” state that still leaves you blind on 443.

Three tickets look identical from the desk (browser red padlock or a broken app) and are three different objects:

• Deep-inspection attached; Fortinet_CA_SSL is not in the client store → NET::ERR_CERT_AUTHORITY_INVALID on every site.
• Certificate-inspection attached; AV “does nothing” on an HTTPS EICAR — the body was never decrypted.
• Deep-inspection attached, CA trusted; one SaaS/desktop app dies — certificate pinning. Exempt that dest. Do not flip the whole profile to no-inspection.

Certificate vs deep — two objects

The profile lives under Security Profiles › SSL/SSH Inspection (config firewall ssl-ssh-profile). You attach it on the firewall policy (set ssl-ssh-profile), same row as IPS / AV. Outbound internet uses Multiple Clients Connecting to Multiple Servers. Inbound to a published TLS server is Protecting SSL Server — a different profile shape (replace/re-sign a specific server cert). This lesson is outbound.

Path · CA, handshake, decrypt, then exempt

How a TLS session is inspected

Existing session first. New 443 from 10.20.20.10 hits policy LAN-to-WAN, then the SSL/SSH profile. Certificate-inspection stops at ClientHello SNI + server cert. Deep-inspection builds two TLS legs: client ↔ FortiGate (cert signed by Fortinet_CA_SSL) and FortiGate ↔ origin (real server cert). Exempt dests skip decrypt and keep the origin cert end-to-end.

When to stay cert-only vs decrypt

Pick the inspection method the UTM feature actually needs. Mixing “we inspect SSL” with certificate-inspection is the usual empty-AV ticket.

Runbook Side A / B / C

Side A is the CA on the client. Side B is the profile and the policy attach. Side C is exemptions and the SSL log. Do not start at B with a live user VLAN.

Side A — trust Fortinet_CA_SSL

1. Download the CA from the profile

   Security Profiles › SSL/SSH Inspection — edit deep-inspection or the clone you will use. Default CA Certificate is Fortinet_CA_SSL. Click Download. Source: FortiOS Administration Guide — Deep inspection (import Fortinet_CA_SSL).

2. Install to Trusted Root on the pilot host

   On 10.20.20.10: Certificate Import Wizard → Trusted Root Certification Authorities. Production: GPO (Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities). macOS/iOS/Firefox have their own stores — a Windows GPO does not cover Chrome-on-Mac or Firefox’s NSS DB.

3. Do not import Fortinet_CA_Untrusted

   Untrusted origin certs re-sign with Fortinet_CA_Untrusted when action is Allow. If warnings remain after a correct SSL CA import, that is this CA — not a broken GPO. Never put it in Trusted Root.

config firewall ssl-ssh-profile
    edit "ssl_lan_wan"
        set caname "Fortinet_CA_SSL"
        set untrusted-caname "Fortinet_CA_Untrusted"
    next
end
# Download remains a GUI/API action from the profile page.
# Confirm the client store separately — FortiOS cannot see the laptop’s Trusted Root.

Side B — profile then policy

1. Create ssl_lan_wan (do not edit the factory deep-inspection)

   Clone custom-deep-inspection or Create New. Multiple Clients Connecting to Multiple Servers. Inspection method = Full SSL Inspection. CA = Fortinet_CA_SSL. Untrusted = Allow (re-sign with Untrusted CA). Keep the default privacy categories unless the pilot has a reason to decrypt banks.

2. Attach on LAN-to-WAN after the CA is on 10.20.20.10

   Policy & Objects › Firewall Policy — Security Profiles: SSL/SSH Inspection = ssl_lan_wan. CLI set utm-status enable then set ssl-ssh-profile "ssl_lan_wan". Log allowed traffic during the pilot.

config firewall ssl-ssh-profile
    edit "ssl_lan_wan"
        set comment "LAN outbound full inspect after CA push"
        config https
            set ports 443
            set status deep-inspection
            set untrusted-server-cert allow
        end
        set caname "Fortinet_CA_SSL"
        set untrusted-caname "Fortinet_CA_Untrusted"
    next
end
config firewall policy
    edit 1
        set name "LAN-to-WAN"
        set srcintf "LAN"
        set dstintf "WAN"
        set srcaddr "LAN_NET"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "ssl_lan_wan"
        set nat enable
        set logtraffic all
    next
end

Side C — pinning exceptions + prove

1. Exempt pinning dests on the profile, not with a second any-any

   On ssl_lan_wan: Exempt from SSL Inspection — keep Finance and Banking / Health and Wellness / Personal Privacy. Add an address or wildcard-FQDN for the app that pins. Enable Log SSL exemptions on the pilot. Source: FortiOS — Exempt web sites from deep inspection; Configuring an SSL/SSH inspection profile.

2. Prove decrypt on a non-exempt site

   From 10.20.20.10 open HTTPS to a dest that is not in ssl-exempt. Padlock → issuer Fortinet_CA_SSL (or your custom CA). No NET::ERR_CERT_AUTHORITY_INVALID. Then Log & Report › Security Events › SSL.

3. Prove the exempt dest kept the origin cert

   Open the pinned/bank URL. Issuer is the public CA, not Fortinet. If Log SSL exemptions is on, that dest has an exemption row — not an ssl-anomaly.

config firewall wildcard-fqdn custom
    edit "PIN_APP"
        set wildcard-fqdn "*.pinned-app.example"
    next
end
config firewall ssl-ssh-profile
    edit "ssl_lan_wan"
        config ssl-exempt
            edit 1
                set type wildcard-fqdn
                set wildcard-fqdn "PIN_APP"
            next
        end
        set ssl-exemptions-log enable
    next
end
# Factory deep-inspection already exempts Finance and Banking,
# Health and Wellness, Personal Privacy in the GUI. Keep them.
# Do not invent FortiGuard category IDs in CLI — use the GUI list
# or an address / wildcard-FQDN you own.

One flow after go-live

Host 10.20.20.10 ClientHello to 203.0.113.80:443. Policy 1 matches. Profile ssl_lan_wan is Full SSL Inspection. Dest is not in ssl-exempt. FortiGate completes TLS to the origin, validates the server cert against its CA bundle, decrypts, runs AV/IPS/Web Filter on the body, re-encrypts to the client with a leaf signed by Fortinet_CA_SSL. Client store has that CA → padlock is quiet. Reply path is the same two TLS legs.

Same host to a Finance and Banking URL: ssl-exempt hits. Origin cert is passed through. Payload UTM does not see the body. Pinning survives because the cert the app pinned is still on the wire.

Same host, CA never imported: every non-exempt site is NET::ERR_CERT_AUTHORITY_INVALID. That is Side A, not a Web Filter block.

Proof · issuer plus SSL events, not a dashboard tile

show firewall policy 1 | grep ssl-ssh-profile
show firewall ssl-ssh-profile ssl_lan_wan
# https status deep-inspection · caname Fortinet_CA_SSL · ssl-exempt list

# Client: padlock on a non-exempt site → Issued by Fortinet_CA_SSL
# Log & Report › Security Events › SSL  (UTM subtype ssl)
# ssl-anomaly / untrusted → origin cert, not a missing client CA

diagnose wad debug enable category ssl
diagnose debug console timestamp enable
diagnose debug enable
# reproduce from 10.20.20.10, then:
diagnose debug disable
diagnose wad debug disable

Traps + proof

Sources

• FortiOS 8.0 Administration Guide — SSL & SSH Inspection (preloaded certificate-inspection, deep-inspection, no-inspection; editable custom-deep-inspection)
• FortiOS 8.0 Administration Guide — Certificate inspection (handshake only; replacement pages signed by FortiGate CA; flow-based does not validate)
• FortiOS 8.0 Administration Guide — Deep inspection (Fortinet_CA_SSL download; never import Fortinet_CA_Untrusted; exempt by address/category/Reputable websites)
• FortiOS 8.0 Administration Guide — Configuring an SSL/SSH inspection profile (Multiple Clients vs Protecting SSL Server; Full SSL vs Certificate Inspection; Exempt from SSL Inspection; HTTP/3 Bypass on cert-inspect)
• FortiOS handbook — Why use SSL inspection (certificate inspection: Web Filter without cert errors; most App Control signatures still need deep inspect)
• Fortinet Community — How FortiGate handles Untrusted SSL certificates (untrusted-server-cert allow|block|ignore; caname / untrusted-caname)
• Fortinet Community — Troubleshooting Tip: A guide to FortiGate and certificate issues (deep inspection + pinning; diagnose wad for proxy inspect)

Related: IPS + App Control · Security profiles + SSL · Zone, policy, NAT · Policy first-match · Command center · FortiGate interview