Trust Root CA

[Enrique Fernandez]

Hi all.

For an installation with many computers, installing the SSL certificate for the SSL inspection can be very difficult.

Is it possible to buy a known root ca certificate so as not to have to install it on clients' web browsers?

If possible, do you know of any known providers?

Thanks in advance.

[rafael....@diladele.com]

No this is not possible, here is the article that explains why -- https://docs.diladele.com/faq/squid/non_root_ca.html

[Enrique Fernandez]

I was not referring to a wildcard certificate.

I wanted to say if it is possible to decrypt by buying a Root CA like Fortigate does for example... 

thanks!.

[rafael....@diladele.com]

Please read the article - it explains that in order to decrypt the connection the proxy ca *must* be root - root cas are not sold, they are generated (fortinet also generated it).

[Enrique Fernandez]

I understand the article, I did not know that root cas were not sold...

With fortigate, you don't have to install the certificate on the clients, do you know how they do it?

Thanks!.

El miércoles, 29 de septiembre de 2021 a las 13:06:48 UTC+2, rafael....@diladele.com escribió:

[rafael....@diladele.com]

Decryption certificate must be installed as trusted into the system. The whole point of TLS is behind this statement.

If anyone was able to decrypt connections to a bank without the installation of a root ca - imagine when a person sits in the airport cafe's wifi network - this would be the end of the known electronic society.

So either they installed the decryption certificate into your system (for example by management solution, at the factory etc) or they do *not* decrypt at all.

One wa to check that is to click on the padlock in your browser address bar when you are on facebook.com for example  - the site certificate was signed by fortigate? if so - root ca is your system somewhere.

If not - they do not decrypt.

br,

Raf

[Enrique Fernandez]

Hi.

I've been checking how Fortigate does it, has two modes: SSL Certificate Inspection and Full SSL Inspection (https://kb.fortinet.com/kb/documentLink.do?externalID=FD35043).

This explains what you have commented in the email above... 

[...]

Conclusion:
If webfilter only is required, SSL Certificate Inspection is the correct option.
If webfilter, identify attacks, viruses and application control are required, then Full SSL Inspection is the best option.

[...]

Thanks for the explanation.