Digital Certificates

Question 1

How does Fortigate use digital certificates?

Answer 1

Inspection
Privacy (SSL connections)
Authentication

Question 2

What standard of certificates does Fortigate support?

Answer 2

X.509v3

Question 3

How does FortiGate validate certificates before trusting it?

Answer 3

Checks local CRL (serial number)
Reads Issuer field to see if it has the corresponding CA certificate.
Verifies date validity
Verifies the digital signature.

Question 4

What is a fresh hash?

Answer 4

Is formed when Fortigate runs the digital cert through the specified has.

Question 5

What is the original hash?

Answer 5

It is when the CA runs the digital cert through its hashing algorithm and then encrypts it.

Question 6

Does Fortigate need SSL to connect to FortiGuard?

Answer 6

yes

Question 7

What can SSL Certificate inspection help you secure? (three things)

Answer 7

Verify ID of web serverse
Web filtering
Application control

Question 8

In order to allow FTG to act as a CA what two extensions need to be configured?

Answer 8

cA=True
keyUsuage=keyCertSign

Question 9

For SSL deep inspection: does FTG need to have a chain of CA certificates installed?

Answer 9

Yes, so that the client can verify and build a chain of trust.

Question 10

What must you select in SSL/SSH inspection profiles to do outbound connections?

Answer 10

You must select Multiple Clients Connecting to Multiple Servers

Question 11

What are the three options for untrusted SSL certificates?

Answer 11

Allow, Block, Ignore

Question 12

What does allow Untrusted SSL certificates do?

Answer 12

Fortigate sends a temporary cert signed with its built-in Fortinet_CA_Untrusted certificate. A warning pops up on the browser.

Question 13

What will happen if you don’t import the Fortinet SSL certificate into the users browser?

Answer 13

A warning will be presented even if Fortinet trusts the original SSL certificate.

Question 14

What will happen if you ignore untrusted browser certificates?

Answer 14

Fortigate sends a temporary cert for all trusted or untrusted certificates.

Question 15

What does HPKP stand for?

Answer 15

HTTP public key pinning

Question 16

What makes a SSL certificate invalid?

Answer 16

Expired
Revoked
Validation timeout (communication timeout)
Validation failed (communication error)

Question 17

To protect inbound SSL traffic what option must you select?

Answer 17

Protecting SSL Server

Question 18

When doing inbound SSL inspection, what do you install to get trust from the browser?

Answer 18

The chain of certificates for the client to build the chain of trust.