FortiGate & Securosys Primus HSM - Enhanced SSL/TLS Inspection Security

SSL/TLS encryption plays a crucial role in securing network traffic, but it also poses a challenge: firewalls must decrypt and re-encrypt traffic to inspect it thoroughly. The Fortinet FortiGate NGFW provides robust, multi-layered security for this process. However, the effectiveness of this protection depends on the secure handling of private keys. If these keys are not adequately safeguarded, the entire security framework can be compromised. Ensuring the highest level of protection for private keys is therefore essential to maintaining network integrity and security.

Solution

Fortinet and Securosys have collaborated to deliver enhanced security using the industry-leading Fortinet FortiGate Next-Generation Firewall (NGFW). With native support for Securosys Primus HSM and CloudHSM, FortiGate ensures that sensitive digital key material is securely offloaded and protected within tamper-resistant hardware security modules, providing a robust layer of security. This partnership embeds trusted key protection directly within FortiGate’s SSL/TLS inspection processes, delivering high availability, seamless integration, and compliance with stringent security standards.

Optimized for mission-critical applications, ensuring high-availability.

Keys remain secure within the HSM, and are never exposed externally.

Compliance with FIPS 140-2 Level 3 and Common Criteria EAL4+ certifications.

Fully compatible with FortiGate, simplifying setup and management.

Available for on-premises (Primus HSM) and cloud (CloudHSM) environments.

Securosys Primus HSM and CloudHSM offer high-entropy, hardware-based true random number generation and tamper-resistant environments for secure key generation and storage. Offloading key management to Securosys HSMs enhances the security of FortiGate’s SSL/TLS inspection.

Regulatory requirements like PCI-DSS, HIPAA, and GDPR demand strict control over cryptographic key management. Integrating FortiGate with Securosys Primus HSM or CloudHSM centralizes key management and meets these compliance standards with certified hardware, reducing risks of key compromise.

Solution Integration

The integration of Securosys Primus HSM with FortiGate enhances security by offloading critical cryptographic key data to a tamper-resistant environment. The HSM securely generates, stores, and manages private keys. During SSL/TLS inspection, short-lived server certificates are issued using these protected keys on the HSM to decrypt the SSL/TLS encrypted traffic. After inspection – and any necessary security remediation by FortiGate – the traffic is re-encrypted before being transmitted to its destination. This approach ensures that private keys remain secure and are never exposed outside the HSM, thereby significantly reducing the risk of key compromise and bolstering the overall integrity of the security architecture.

Securosys Hardware Security Modules are available as on-premises solutions (Primus HSM) or as cloud service (CloudHSM). CloudHSM minimizes customers’ time for evaluation, setup, operation, redundancy, and maintenance of the HSM infrastructure. Moreover, it is scalable according to customer needs.

Fortinet Solution Brief - Graphic 2

Fortinet FortiGate

Challenge

Solution

Key Benefits

Use Cases

Solution Integration

Resources

Fortinet FortiGate

Challenge

Solution

Key Benefits

Use Cases

Solution Integration

Resources

Related Products