Why use SSL inspection

Most of us are familiar with Hypertext Transfer Protocol Secure (HTTPS) and how it protects a variety of activities on the Internet by applying Secure Sockets Layer (SSL) encryption to the web traffic. However, there are risks associated with its use, since encrypted traffic can be used to get around your network’s normal defenses.

For example, you might download a file containing a virus during an e-commerce session. Or you could receive a phishing email containing a seemingly harmless downloader file that, when launched, creates an encrypted session to a command and control (C&C) server and downloads malware onto your computer. Because the sessions in these attacks are encrypted, they might get past your network’s security measures.

To protect your network from these threats, SSL inspection is the key your FortiGate uses to unlock encrypted sessions, see into encrypted packets, find threats, and block them. SSL inspection not only protects you from attacks that use HTTPS, but also from other commonly used SSL-encrypted protocols, such as SMTPS, POP3S, IMAPS, and FTPS.

SSL certificate

Full SSL inspection

To make sure that all SSL encrypted content is inspected, you must use full SSL inspection (also known as deep inspection). When full SSL inspection is used, the FortiGate impersonates the recipient of the originating SSL session, then decrypts and inspects the content. The FortiGate then re-encrypts the content, creates a new SSL session between the FortiGate and the recipient by impersonating the sender, and sends the content to the sender.

When the FortiGate re-encrypts the content it uses a certificate stored on the FortiGate. The client must trust this certificate to avoid certificate errors. Whether or not this trust exists depends on the client, which can be the computer’s OS, a browser, or some other application, which will likely maintain it’s own certificate repository. For more information about this, see the recipe Preventing certificate warnings on the Fortinet Cookbook site.

There are two deployment methods for full SSL inspection:

1. Multiple Clients Connecting to Multiple Servers:

• Uses a CA certificate (which can be uploaded using the Certificates menu). l Typically applied to outbound policies where destinations are unknown (i.e. normal web traffic).
• Address and web category whitelists can be configured to bypass SSL inspection.

2. Protecting SSL Server l Uses a server certificate (which can be uploaded using the Certificates menu) to protect a single server.

• Typically used on inbound policies to protect servers available externally through Virtual IPs
• Since this is typically deployed “outside-in” (clients on the Internet accessing server(s) on the internal side of the

FortiGate), server certificates using the public FQDN of the server are often purchased from a commercial Certificate Authority and uploaded to the FortiGate. This avoids client applications generating SSL certificate errors due to certificate mismatch.

More detail is available in the Fortinet Knowledge Base. Check these technical notes:

• How to Enable SSL inspection from the CLI and Apply it to a Policy
• How to block web-based chat on Gmail webmail using App Sensor + SSL inspection