Certificate inspection

FortiGate supports certificate inspection. The default configuration has a built-in certificate-inspection profile which you can use directly. When you use certificate inspection, the FortiGate only inspects the headers up to the SSL/TLS layer.

If you do not want to deep scan for privacy reasons but you want to control web site access, you can use certificate-inspection.

SSL inspection options

The following options are available when configuring an SSL inspection profile:

Enable SSL inspection of	Select Multiple Clients Connecting to Multiple Servers. This is normally used when inspecting outbound internet traffic
Inspection method	Select SSL Certificate Inspection.
CA certificate	Use the default Fortinet_CA_SSL certificate.
Blocked certificates	The FortiGate receives Botnet C&C SSL connections from FortiGuard that contain SHA1 fingerprints of malicious certificates. By default, these certificates are blocked. Click View Blocked Certificates to see a detailed list.
Untrusted SSL certificates	Configure the action to take when a server certificate is not issued by a trusted CA. Allow: Allow the untrusted server certificate. This is the default value. Block: Block the session Ignore: This option is for Full SSL inspection only. It re-signs the server certificate as trusted. When configured in the GUI for certificate inspection it has no effect and the setting is not saved. Click View Trusted CAs List to see a list of the factory bundled and user imported CAs that are trusted by the FortiGate.
Server certificate SNI check	Check the SNI in the hello message with the CN or SAN field in the returned server certificate. Enable: If mismatched, use the CN in the server certificate to do URL filtering. Strict: If mismatched, close the connection. Disable: Server certificate SNI check is disabled.

When a firewall policy is in flow-based inspection mode, SSL Certificate Inspection does not validate the certificate. Untrusted SSL certificates and Server Certificate SNI checks are not performed. If these features are needed, use proxy‑based inspection mode.

Inspect non-standard HTTPS ports

The built-in certificate-inspection profile is read-only and only listens on port 443. If you want to make changes, you must create a new certificate inspection profile.

If you know the non-standard port that the web server uses, such as port 8443, you can add this port to the HTTPS field.

To add a port to the inspection profile in the GUI:

1. Go to Security Profiles > SSL/SSH Inspection.

2. Create a new profile, or clone the default profile.

3. If you do no know what port is used in the HTTPS web server, under Protocol Port Mappingenable Inspect All Ports.

   If you know the port, such as port 8443, then set HTTPS to 443,8443.

   

4. Configure the remaining setting as needed.

5. Click OK.

Common options

Invalid SSL certificates can be blocked, allowed, or a different actions can be configured for the different invalid certificates types:

Expired certificates	Action to take when the server certificate is expired. The default action is block.
Revoked certificates	Action to take when the server certificate is revoked. The default action is block.
Validation timed-out certificates	Action to take when the server certificate validation times out. The default action is allow.
Validation failed certificates	Action to take when the server certificate validation fails. The default action is block.

When a firewall policy is in flow-based inspection mode, SSL Certificate Inspection does not validate the certificate. Expired certificates and Revoked certificates checks are not performed, and the Validation timed-out certificates and Validation failed certificates actions do not apply. If these features are needed, use proxy‑based inspection mode.

By default, SSL anomalies logging is enabled. Logs are generated in the UTM log type under the SSL subtype when invalid certificates are detected.