Skip to content

Create a new Fortinet FortiADC machine

Create a machine for your Fortinet FortiADC so that Certificate Manager - SaaS can find the TLS certificates your virtual servers present to clients and install renewed certificates on the appliance. Certificate Manager - SaaS connects to the FortiADC REST API by using an API key.

Before you begin

  • A FortiADC appliance running version 7.2 or later.
  • The hostname or IP address of the FortiADC management interface.
  • The HTTPS management port, if it isn't 443. The REST API uses the same port as the web interface.
  • At least one active VSatellite connection that can reach:
    • The FortiADC management interface on that port.
    • The address and port of every virtual server whose certificates you want to discover. Certificate Manager - SaaS reads each certificate from the TLS connection to the virtual server that serves it.
  • The API key of a FortiADC REST API administrator account. See Prepare the FortiADC.

Note

Certificate Manager - SaaS doesn't yet verify the certificate that the FortiADC management interface presents. The connection is still encrypted.

Prepare the FortiADC

Do these steps once on the FortiADC. Creating the REST API administrator account requires full administrator (super-admin) rights. The account itself needs only the access profile you create in step 1.

  1. Create an access profile with these permissions:

    • System: read-write. FortiADC manages certificates under this category.
    • Server Load Balance: read-only. Certificate Manager - SaaS reads client SSL profiles and virtual servers but doesn't change them.

  2. In System > Administrator, create a REST API administrator account, and select the access profile as its Administrator profile. When you save the account, copy the API key. The appliance doesn't show it again. For details, see Create REST API administrator users in the FortiADC documentation.

  3. If you turn on Restrict to trusted hosts for the account, enter the address of each VSatellite that connects to the appliance in Trusted Hosts, separated by spaces, for example 192.0.2.1/32 192.0.2.2/32. If a VSatellite address is missing, the appliance rejects the API key and Test Access fails.

If virtual domains are turned on, only a global administrator account can list them. For least privilege, create one machine for each virtual domain:

  • Create a REST API administrator account for the virtual domain. Set Global Admin to No, assign the account to the virtual domain, and use the access profile from step 1.
  • When you configure discovery for the machine, list the virtual domain under Virtual Domains.

A global administrator account can discover every virtual domain from one machine, but it has full administrator rights.

Note

If you regenerate the API key on the FortiADC, the previous key stops working. Update the machine's API Key in Certificate Manager - SaaS with the new key.

Create the machine

  1. In Server Hostname, enter the hostname or IP address of the FortiADC management interface.

  2. In Port, enter the HTTPS management port. The default is 443. Change it only if the appliance's management port was changed.

  3. In API Key, enter the API key of the REST API administrator account.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  4. Click Test Access, then click Continue. Continue is enabled only after the test succeeds.

    Note

    If the test fails, Certificate Manager - SaaS doesn't show the reason. The connector log on the VSatellite records it, for example that the appliance rejected the API key, or that the connection timed out. Check that the hostname and port are correct, that the API key is current, that the VSatellite can reach the management interface, and, if the account is restricted to trusted hosts, that the VSatellite address is one of them.

    The first test after you create the machine can time out while the connector starts, with a message that the VSatellite exceeded the time limit. Click Test Access again.

    A successful test doesn't prove that the account can provision, because the test needs only read access to System. If the access profile is missing a write permission, the first provisioning fails with "Permission denied."

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling. When you configure discovery, you can set these options:

  • Virtual Domains limits discovery to the virtual domains you list. Leave it empty to discover every virtual domain. If virtual domains are turned on, that requires a global administrator account. If virtual domains are turned off, you can list only global. Don't list both global and root. The root virtual domain also lists the global certificates, so they'd be discovered twice.
  • Exclude Expired Certificates skips certificates that have already expired.

Discovery finds only certificates that a virtual server serves

The FortiADC API doesn't return certificate content, so Certificate Manager - SaaS reads each certificate from a TLS connection to an enabled virtual server that serves it. Certificate Manager - SaaS skips certificates that no enabled virtual server serves, and certificates whose virtual server the VSatellite can't reach. It lists skipped certificates by name in the connector log on the VSatellite.

Each discovered installation records the certificate's virtual domain, local certificate group, intermediate CA group, client SSL profile, virtual server, and port. If a virtual server listens on more than one port, the installation records the first port it lists.

If you move a certificate to a different virtual server or client SSL profile on the appliance, the next discovery creates a new installation and marks the old one as Missing. Discovery also marks installations as Missing when:

  • You turn on virtual domains on the appliance. The FortiADC moves the global objects into the root virtual domain, so discovery creates new installations for them.
  • You limit Virtual Domains. Installations in the virtual domains you don't list are marked Missing.

Certificate Manager - SaaS doesn't remove Missing installations. Delete them in Certificate Manager - SaaS when you no longer need them.

For existing machines: