{{ secondMenu.name }}
Because Fortigate's SSL Decryption configuration file differs significantly from NGFW, it is recommended to understand Fortigate's SSL Decryption protection capabilities before configuring it according to Sangfor NGFW's SSL decryption policy.
Decryption is used for the decryption scenarios of encrypted emails and HTTPS data for LAN users who access the internet through the device and the scenario where the LAN has an encrypted server, and the Network Secure device decrypts the traffic accessing the server to protect the server. You must enable multi-functional authorization to enable this function.
The service released by the decryption intranet server applies to the encryption server on the LAN. The Network Secure device detects the server's traffic by decrypting the traffic accessing the server to protect the server from attacks. See the figure below.
A web application server is deployed on the intranet of an enterprise to provide internal and external services. The web application server is transmitted via HTTPS protocols. To prevent the web server from being attacked, HTTPS traffic must be detected to ensure the security of the server. 
Import the HTTPS server certificate. Click Server Certificate. Then, the Add Server Certificate dialog box appears. Click Add to create a server certificate, as shown in the following figure. 
| Form of certificate |
Note |
| Import Certificate |
Import a certificate file suffixed with .pfx or .p12. The file contains the public key, private key, and password. Enter the password to decrypt the file. |
| Specify Self-Signed |
Indicate the custom certificate. You need to manually specify the Name, Country, Issued To, Key Type, Key Size, and Validity Period parameters. The rest parameters are optional. A self-signed certificate can be generated after the preceding parameters are set. |
| Import Public/Private |
Import a public or private key certificate. The public key certificate supports a file suffixed with .PEM or .DER, and the private key certificate supports a file suffixed with .PEM, .DER, or .PVK. Click OK after the certificate is imported. |
Description of Form of Certificate
Click Add to create a decryption policy and enter the corresponding information, as shown in the following figure. 
Name: Enter a policy name easy to identify.
Src Zones: Select the source zone for accessing the server.
Source: Enter the network objects that will access the server.
Decryption Type: If you select Decrypt data to internal server, the encryption server is deployed in the LAN zone of Network Secure. The Decrypt data to internet option applies to the decryption of emails and HTTPS data when LAN users access the Internet.
Destination Servers: Add the IP address and port of the server to be decrypted. Web server, Mail server, FTP server, and Other servers are available.
Server Certificate: Select the certificate of the encryption server. You need to import the server certificate on the Add Server Certificate page.
Click OK to save the settings. Then, the policy is added.
Decrypting data to the internet applies to the decryption of emails and HTTPS data when LAN users access the internet through the device. See the figure below. 
Name: Enter a policy name easy to identify.
Src Zones: Select the source zone for accessing the internet.
Source: Enter the network objects that will access the server.
Decryption Type: Select Decrypt data to internet.
Dst Websites: Select All or Selected. If you select Selected, select the site category to be decrypted from the URL category database. 
Root Certificate: When the decryption function is enabled, a certificate alert message is prompted to a user who accesses the HTTPS website. To avoid this message, select this option and set the URL from which the root certificate is downloaded.
1. To enable the decryption function, multi-functional authorization must be enabled.
2. This function may impose some pressure on the device's performance. Do not enable it arbitrarily.
3. By default, the encrypted emails of LAN users accessing the WAN are decrypted. You only need to enable a policy for decrypting data accessing sites. The rest of the operations only need to be set in the content security policy.
4. Security of encrypted emails, HTTPS antivirus, HTTPS webpage filtration, and the filtration of HTTPS uploads and downloads rely on the decryption of data accessing sites.
{{ $t('index.defaultHeader.chromeBrowserTip') }}