Skip to content

Create a Fortinet FortiGate machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Create a Fortinet FortiGate machine so Certificate Manager - SaaS can discover and provision the certificates on a FortiGate firewall. Discovery scans every virtual domain (VDOM) on the device, and Certificate Manager - SaaS tracks each certificate by VDOM, so certificates with the same name in two VDOMs appear as separate installations.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach the FortiGate management interface on the HTTPS management port.
  • The fully qualified domain name (FQDN) or IP address of the FortiGate management interface, and its HTTPS management port if it isn't 443.
  • A FortiGate REST API administrator and its API token, or an administrator account with a username and password. If the REST API administrator has trusted hosts, include the egress IP address of the VSatellite.
  • An administrator profile with read and write access to local and CA certificates, global system settings, SSL VPN settings, firewall virtual IPs (VIPs), Internet Protocol Security (IPsec) phase 1 interfaces, SSL/SSH inspection profiles, and VDOMs.
  • On a device with more than one VDOM, administrator access to every VDOM. If the administrator can't read the certificates in a VDOM, discovery stops with an error rather than report an incomplete inventory.

To create a Fortinet FortiGate machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Fortinet FortiGATE (Preview).
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In FortiGATE Hostname or IP Address, enter the FQDN or IP address of the FortiGate management interface.

  8. (Optional) In HTTPS Management Port, enter the port if the management interface doesn't listen on 443. If you leave it empty, Certificate Manager - SaaS uses 443.

  9. For Authentication Method, choose how Certificate Manager - SaaS signs in to FortiGate:

    • API Token to use the token of a REST API administrator. This is the default.
    • Username / Password to sign in with an administrator account. Credential Type appears only for this method.

  10. If you chose API Token, in API Token, enter the token of the REST API administrator.

  11. (Optional) If you chose API Token and the REST API administrator requires a client certificate, in Client Certificate (PEM, optional mTLS) and Client Private Key (PEM, optional mTLS), enter the PEM-encoded certificate and its private key. Certificate Manager - SaaS presents them as a second factor during mutual TLS (mTLS). Enter both or neither.

  12. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  13. If you chose Username / Password and Enter Credentials, enter the Username and Password of the FortiGate administrator account. If you chose Select Credentials, the stored account needs the same FortiGate access.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  14. (Optional) To connect without verifying the certificate of the management interface, enable Skip TLS Certificate Verification. Enable it only if the management interface uses a self-signed or untrusted certificate. The connection is still encrypted, but Certificate Manager - SaaS doesn't validate the server certificate.

  15. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can reach FortiGate and that FortiGate accepts the credentials. It doesn't check the administrator's permissions or VDOM access. If you entered a client certificate, a successful test also doesn't prove that FortiGate checks it, because FortiGate checks the certificate only when the REST API administrator requires one.

    The Discovery step has no filter options. Discovery always detects every VDOM on the device and reads each VDOM's certificate store. It skips the certificates that FortiOS installs itself, including the public root CAs of its CA bundle.

  16. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  17. Click Continue. The Provisioning step opens.

  18. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  19. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates in each VDOM.