How to offload or inspect HTTPS. Fortinet FortiWeb 5.1 Patch 3
โฆษณา
โฆษณา
6. Click Create New.
A dialog appears.
7. In ID, enter the index number of the host entry within the group, or keep the field’s default value of auto to let the FortiWeb appliance automatically assign the next available index number.
8. In CA, select the name of a certificate authority’s certificate that you previously uploaded and want to add to the group.
9. Click OK.
10.Repeat the previous steps for each CA that you want to add to the group.
11.To apply a CA group, select it in a certificate verification rule (see
“Configuring FortiWeb to validate client certificates” on page 331
).
See also
•
Configuring FortiWeb to validate client certificates
How to offload or inspect HTTPS
Whether offloading or merely inspecting for HTTPS, FortiWeb must have a copy of your protected web servers’ X.509 server certificates. FortiWeb also has its own server certificate, which it uses to prove its own identity.
Which certificate will be used, and how, depends on the purpose.
•
For connections to the web UI
— The FortiWeb appliance presents its own (“default” or
“Fortinet_Factory”) certificate.
The FortiWeb appliance’s default certificate does not appear in the list of locally stored certificates. It is used only for connections to the web UI and cannot be removed.
•
For SSL offloading or SSL inspection
— Server certificates do not belong to the FortiWeb appliance itself, but instead belong to the protected web servers. FortiWeb uses the web server’s certificate because it either acts as an SSL agent for the web server, or is privy to its secure connections for the purpose of scanning. You must select which one the FortiWeb appliance will use when configuring
“Configuring a server policy” on page 512
in a server farm (see “Uploading a server certificate” on page 303
).
System > Certificates > Local displays all X.509 server certificates that are stored locally, on the
FortiWeb appliance, for the purpose of offloading or scanning HTTPS.
Fortinet 297 FortiWeb 5.1 Patch 3 Administration Guide
Table 35: System > Certificates > Local
Fortinet
Button/field
Generate
Import
View Certificate
Detail
Download
Edit Comments
(No label. Check box in column heading.)
Name
Subject
Comments
Status
Description
Click to generate a certificate signing request. For details, see
“Generating a certificate signing request” on page 299 .
Click to upload a certificate. For details, see “Uploading a server certificate” on page 303 .
Click to view the selected certificate’s subject, range of dates within which the certificate is valid, version number, serial number, and extensions.
Click to download the selected CSR’s entry in certificate signing request (.csr) file format.
This button is disabled unless the currently selected file is a CSR.
Click to add or modify the comment associated with the selected certificate.
Click to mark all check boxes in the column, selecting all entries.
To select an individual entry, instead, mark the check box in the entry’s row.
Displays the name of the certificate.
Displays the distinguished name (DN) located in the
Subject: field of the certificate.
If the row contains a certificate request which has not yet been signed, this field is empty.
Displays the description of the certificate, if any. Click the Edit
Comments icon to add or modify the comment associated with the certificate or certificate signing request.
Displays the status of the certificate.
• OK — Indicates that the certificate was successfully imported.
To use the certificate, select it in a server policy or server farm.
• PENDING — Indicates that the certificate request has been generated, but must be downloaded, signed, and imported before it can be used as a server certificate.
FortiWeb presents a server certificate when any client requests a secure connection, including when:
• Administrators connect to the web UI (HTTPS connections only)
• Clients use SSL or TLS to connect to a virtual server, if you enabled SSL offloading in the policy (HTTPS connections and reverse proxy mode only)
298 FortiWeb 5.1 Patch 3 Administration Guide
Fortinet
Although they do not present a certificate during SSL/TLS inspection, FortiWeb still requires server certificates in order to decrypt and scan HTTPS connections travelling through it (SSL inspection) if operating in any mode except reverse proxy. Otherwise, FortiWeb will not be able to scan the traffic, and will not be able to protect that web server.
If you want clients to be able to use HTTPS with your web site, but your web site does not already have a server certificate to represent its authenticity, you must first generate a certificate signing request (see
“Generating a certificate signing request” on page 299 ). Otherwise, start
with
“Uploading a server certificate” on page 303 .
See also
•
•
How operation mode affects server policy behavior
•
Grouping your web servers into server farms
•
Generating a certificate signing request
•
Uploading a server certificate
•
Revoking certificates by OCSP query
•
•
Supported cipher suites & protocol versions
•
Uploading trusted CAs’ certificates
Generating a certificate signing request
Many commercial certificate authorities (CAs) will provide a web site where you can generate your own certificate signing request (CSR). A CSR is an unsigned certificate file that the CA will sign. When the CSR is generated, the associated private key that the appliance will use to sign and/or encrypt connections with clients is also generated.
If your CA does not provide this, or if you have your own private CA such as a Linux server with
OpenSSL, you can use the appliance generate a CSR and private key. This CSR can then be submitted for verification and signing by the CA.
To generate a certificate request
1. Go to System > Certificates > Local.
To access this part of the web UI, your administrator's account access profile must have
Read and Write permission to items in the Admin Users category. For details, see
2. Click Generate.
A dialog appears.
299 FortiWeb 5.1 Patch 3 Administration Guide
3. Configure the certificate signing request:
Fortinet
Setting name
Certification Name
Key Type
Key Size
Enrollment Method
Description
Enter a unique name for the certificate request, such as www.example.com. This can be the name of your web site.
Displays the type of algorithm used to generate the key.
This option cannot be changed, but appears in order to indicate that only RSA is currently supported.
Select a secure key size of 512 Bit, 1024 Bit, 1536 Bit or
2048 Bit. Larger keys are slower to generate, but provide better security.
Select either:
• File Based — You must manually download and submit the resulting certificate request file to a certificate authority (CA) for signing. Once signed, upload the local certificate.
• Online SCEP — The FortiWeb appliance will automatically use HTTP to submit the request to the simple certificate enrollment protocol (SCEP) server of a CA, which will validate and sign the certificate. For this selection, two options appear. Enter the CA
Server URL and the Challenge Password.
300 FortiWeb 5.1 Patch 3 Administration Guide
Fortinet
Setting name
Subject Information
ID Type
IP
Description
Includes information that the certificate is required to contain in order to uniquely identify the FortiWeb appliance. This area varies depending on the ID Type selection.
Select the type of identifier to use in the certificate to identify the FortiWeb appliance:
• Host IP — Select if the FortiWeb appliance has a static IP address and enter the public IP address of the FortiWeb appliance in the IP field. If the FortiWeb appliance does not have a public IP address, use
E-Mail or Domain Name instead.
•
Domain Name
— Select if the FortiWeb appliance has a static IP address and subscribes to a dynamic DNS service. Enter the FQDN of the FortiWeb appliance, such as www.example.com, in the Domain Name field. Do not include the protocol specification (http://) or any port number or path names.
•
— Select and enter the email address of the owner of the FortiWeb appliance in the e-mail field.
Use this if the appliance does not require either a static IP address or a domain name.
The type you should select varies by whether or not your
FortiWeb appliance has a static IP address, a fully-qualified domain name (FQDN), and by the primary intended use of the certificate.
For example, if your FortiWeb appliance has both a static
IP address and a domain name, but you will primarily use the local certificate for HTTPS connections to the web UI by the domain name of the FortiWeb appliance, you might prefer to generate a certificate based upon the domain name of the FortiWeb appliance, rather than its IP address.
Depending on your choice for ID Type, related options appear.
Type the static IP address of the FortiWeb appliance, such as
10.0.0.1.
The IP address should be the one that is visible to clients.
Usually, this should be its public IP address on the
Internet, or a virtual IP that you use NAT to map to the appliance’s IP address on your private network.
This option appears only if ID Type is Host IP.
Domain Name
Type the fully qualified domain name (FQDN) of the
FortiWeb appliance, such as www.example.com.
The domain name must resolve to the static IP address of the FortiWeb appliance or protected server. For more
information, see “Configuring the network interfaces” on page 120 .
This option appears only if ID Type is Domain Name.
301 FortiWeb 5.1 Patch 3 Administration Guide
Fortinet
Setting name
Optional Information
Organization unit
Description
Type the email address of the owner of the FortiWeb appliance, such as [email protected].
This option appears only if ID Type is E-Mail.
Includes information that you may include in the certificate, but which is not required.
Type the name of your organizational unit (OU), such as the name of your department. This is optional.
To enter more than one OU name, click the + icon, and enter each OU separately in each field.
Type the legal name of your organization. This is optional.
Organization
Locality(City)
Type the name of the city or town where the FortiWeb appliance is located. This is optional.
State/Province
Type the name of the state or province where the
FortiWeb appliance is located. This is optional.
Country/Regio n e-mail
Select the name of the country where the FortiWeb appliance is located. This is optional.
Type an email address that may be used for contact purposes, such as [email protected].
This is optional.
4. Click OK.
The FortiWeb appliance creates a private and public key pair. The generated request includes the public key of the FortiWeb appliance and information such as the FortiWeb appliance’s IP address, domain name, or email address. The FortiWeb appliance’s private key remains confidential on the FortiWeb appliance. The Status column of the entry is
PENDING.
5. Select the row that corresponds to the certificate request.
6. Click Download.
Standard dialogs appear with buttons to save the file at a location you select. Your web browser downloads the certificate request (.csr) file. Time required varies by the size of the file and the speed of your network connection.
7. Upload the certificate request to your CA.
After you submit the request to a CA, the CA will verify the information in the certificate, give it a serial number, an expiration date, and sign it with the public key of the CA.
8. If you are not using a commercial CA whose root certificate is already installed by default on web browsers, download your CA’s root certificate, then install it on all computers that will be connecting to your appliance. (If you do not install these, those computers may not trust your new certificate.)
9. When you receive the signed certificate from the CA, upload the certificate to the FortiWeb
appliance (see “Uploading a server certificate” on page 303
).
See also
•
Uploading a server certificate
302 FortiWeb 5.1 Patch 3 Administration Guide
Fortinet
Uploading a server certificate
You can import (upload) either:
• Base64-encoded
• PKCS #12 RSA-encrypted
X.509 server certificates and private keys to the FortiWeb appliance.
DSA-encrypted certificates are not supported if the FortiWeb appliance is operating in a mode other than reverse proxy. See
“Supported features in each operation mode” on page 69
.
If a server certificate is signed by an intermediate certificate authority (CA) rather than a root CA, before clients will trust the server certificate, you must demonstrate a link with root CAs that the clients trust, thereby proving that the server certificate is genuine. You can demonstrate this chain of trust either by:
• Appending a signing chain in the server certificate.
• Uploading and configuring a signing chain separately (see
“Supplementing a server certificate with its signing chain” on page 305 ).
• Installing each intermediary CA’s certificate in clients’ trust store (list of trusted CAs).
Which method is best for you often depends on whether you have a convenient method for deploying CA certificates to clients, such as you may be able to for clients in an internal
Microsoft Active Directory domain, and whether you often refresh the server certificate.
To append a signing chain in the certificate itself, before uploading the server certificate
to the FortiWeb appliance
1. Open the certificate file in a plain text editor.
2. Append the certificate of each intermediary CA in order from the intermediary CA who signed the local certificate to the intermediary CA whose certificate was signed directly by a trusted root CA.
For example, a server’s certificate that includes a signing chain might use the following structure:
-----BEGIN CERTIFICATE-----
<server certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 1, who signed the server certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 2, who signed the certificate of intermediate CA 1 and whose certificate was signed by a trusted root
CA>
-----END CERTIFICATE-----
3. Save the certificate.
303 FortiWeb 5.1 Patch 3 Administration Guide
To upload a certificate
The total file size of all certificates, private keys, and any other uploaded files may not exceed
12 MB.
1. Go to System > Certificates > Local.
To access this part of the web UI, your administrator's account access profile must have
Read and Write permission to items in the Admin Users category. For details, see
2. Click Import.
A dialog appears.
3. Configure these settings:
Fortinet
Setting name
Type
Certificate file
Key file
Certificate with key file
Password
Description
Select the type of certificate file to upload, either:
• Local Certificate — An unencrypted certificate in PEM format.
• Certificate — An unencrypted certificate in PEM format.
The key is in a separate file.
• PKCS12 Certificate — A PKCS #12 encrypted certificate with key.
Other fields may appear depending on your selection.
Click Browse to locate the certificate file that you want to upload.
This option is available only if
Type
is Certificate or Local
Certificate.
Click Browse to locate the key file that you want to upload with the certificate.
This option is available only if
Type
is Certificate.
Click Browse to locate the PKCS #12 certificate-with-key file that you want to upload.
This option is available only if
Type
is PKCS12 Certificate.
Type the password that was used to encrypt the file, enabling the FortiWeb appliance to decrypt and install the certificate.
This option is available only if
Type
is Certificate or PKCS12
Certificate.
4. Click OK.
304 FortiWeb 5.1 Patch 3 Administration Guide
Fortinet
5. To use a certificate, you must select it in a policy or server farm (see
“Configuring a server policy” on page 512
or “Grouping your web servers into server farms” on page 265 ).
See also
•
Supplementing a server certificate with its signing chain
•
Revoking certificates by OCSP query
•
•
Grouping your web servers into server farms
•
How to offload or inspect HTTPS
Supplementing a server certificate with its signing chain
If a server certificate is signed by an intermediate (non-root) certificate authority rather than a root CA, before the client will trust the server’s certificate, you must demonstrate a link with trusted root CAs, thereby proving that the server’s certificate is genuine. Otherwise, the server certificate may cause the end-user’s web browser to display certificate warnings.
If you did not append the signing chain inside the server certificate itself, you must configure the
FortiWeb appliance to provide the certificates of intermediate CAs when it presents the server certificate.
To upload an intermediate CA’s certificate
The total file size of all certificates, private keys, and any other uploaded files may not exceed
12 MB.
1. Go to System > Certificates > Intermediate CA.
You can click View Certificate Detail to view the selected certificate’s subject, range of dates within which the certificate is valid, version number, serial number, and extensions
(purposes).
To access this part of the web UI, your administrator's account access profile must have
Read and Write permission to items in the Admin Users category. For details, see
2. To upload a certificate, click Import.
A dialog appears.
305 FortiWeb 5.1 Patch 3 Administration Guide
3. Do one of the following to locate a certificate:
• Select SCEP and enter the URL of the applicable Simple Certificate Enrollment Protocol server. (SCEP allows routers and other intermediate network devices to obtain certificates.)
To specify a specific certificate authority, enter an identifier in the field below the URL.
• Select Local PC, then browse to locate a certificate file.
4. Click OK.
5. Go to System > Certificates > Intermediate CA Group.
To access this part of the web UI, your administrator's account access profile must have
Read and Write permission to items in the Admin Users category. For details, see
6. Click Create New.
A dialog appears.
Clear
Edit
Delete
7. In Name, type a name that can be referenced by other parts of the configuration. Do not use spaces or special characters. The maximum length is 35 characters.
8. Click OK.
9. Click Create New.
A dialog appears.
Fortinet
10.In ID, type the index number of the host entry within the group, or keep the field’s default value of auto to let the FortiWeb appliance automatically assign the next available index number.
11.In CA, select the name of an intermediary CA’s certificate that you previously uploaded and want to add to the group.
12.Click OK.
13.Repeat the previous steps for each intermediary CA certificate that you want to add to the group.
14.To apply an intermediary CA certificate group, select it in
Certificate Intermediate Group
in a policy that uses HTTPS, with the server certificate that was signed by those CAs (see
“Configuring a server policy” on page 512
).
The FortiWeb appliance will present both the server’s certificate and those of the intermediate CAs when establishing a secure connection with the client.
306 FortiWeb 5.1 Patch 3 Administration Guide
ดาวน์โหลด
ลิงก์สาธารณะได้รับการอัปเดตแล้ว
ลิงก์สาธารณะไปยังแชทของคุณได้รับการอัปเดตแล้ว You may view and manage your chat links after registration here.
ลิงก์สาธารณะของเอกสาร
โฆษณา