Fortinet 5.0 Patch 6

Fortinet 278 FortiWeb 5.0 Patch 6 Administration Guide

When SSL offloading, the web server does not use its own server certificate. Instead,

FortiWeb acts like an SSL proxy for the web server, possessing the web server’s certificate and

using it to:

• authenticate itself to clients

• decrypt requests

• encrypt responses

whenever a client requests an HTTPS connection to that web server.

As a side effect of being an SSL terminator, the FortiWeb is in possession of both the HTTP

request and reply in their decrypted state. Because they are not encrypted at that point on the

path, FortiWeb can rewrite content and/or route traffic based upon the contents of Layer 7 (the

application layer). Otherwise Layer 7 content-based routing and rewriting would be impossible:

that part of the packets would be encrypted and unreadable to FortiWeb.

However, depending on the operation mode, FortiWeb is not always an SSL terminator.

By their asynchronous nature, SSL termination cannot be supported in transparent inspection

and offline protection modes. (To terminate, FortiWeb must process traffic synchronously with

the connection state.) In those modes, the web server uses its own certificate, and acts as

its own SSL terminator. The web server bears the load for SSL processing. FortiWeb only

“listens in” and can interrupt the connection, but otherwise cannot change or reroute packets.

In those modes, FortiWeb only uses the web server’s certificate to decrypt traffic in order to

scan it for policy violations. If there are no violations, it allows the existing encrypted traffic to

continue without interruption. FortiWeb does not expend CPU and resources to re-encrypt,

because it is not a terminator.

In other words, FortiWeb performs SSL inspection, not SSL offloading.