Security alert message when connecting to Fortinet unit

‎08-31-2005

Article

Issue

Users often see two security alert messages when they connect to a Fortinet unit with their web browser via HTTPS (SSL/TLS).

Components

All FortiGate, FortiWiFi, FortiMail, FortiLog and FortiManager units.

All firmware versions

Description

Upon connecting to the FortiGate's GUI interface, using a web browser in HTTPS mode, the following may be displayed:

(Internet Explorer)

Screen capture of a security alert message from Microsoft Internet Explorer.

(Mozilla)

Screen capture of a Certificate Authority Warning message from a Mozilla browser.

Screen capture of the Domain Name Mismatch warning message.

The first message indicates that the security authority (CA) who issued the certificate is not trusted by the user. This is because the Fortinet device's certificate is self-signed. Users need to trust the CA who issued the certificate in order to proceed.

The second warning message indicates that the name of the server you are connecting to, doesn't match the comman name (CN) in the certificate. This is because you are accessing the unit via its IP address, or a DNS entry, which does not match the hardcoded CN of 'Fortinet' within the certificate.

The user may install the certificate (View Certificate->Install Certificate) so as avoid this warning in the future, otherwise simply accepting to proceed is sufficient to access the GUI.