Skip to content

Create a Fortinet FortiWeb machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Create a Fortinet FortiWeb machine so Certificate Manager - SaaS can discover the certificates on the Web Application Firewall (WAF) and provision certificates to it. Certificate Manager - SaaS connects to the FortiWeb REST management interface through a VSatellite, with an administrator's username and password. API tokens and mutual TLS (mTLS) authentication aren't supported.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach the FortiWeb management interface on the admin HTTPS port.
  • The hostname or IP address of the FortiWeb.
  • The admin HTTPS port of the FortiWeb, if it isn't the default, 8443. FortiWeb uses 8443 for the management interface, not 443.
  • The username and password of a FortiWeb administrator account with REST API access and permission to:
    • Read and write local, CA, and intermediate CA certificates.
    • Read and write server policies and Server Name Indication (SNI) groups.
    • Read and write global system settings. You need this permission only to provision the management interface certificate.
  • If the appliance uses administrative domains (ADOMs), an account that can access every ADOM whose certificates you want to manage. The built-in admin account can access all ADOMs.

To create a Fortinet FortiWeb machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Fortinet FortiWEB (Preview).
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In FortiWeb Hostname or IP Address, enter the hostname or IP address of the FortiWeb.

  8. (Optional) In Admin HTTPS Port, replace the default, 8443, if you changed the admin HTTPS port on the appliance.

  9. In Username and Password, enter the credentials of the FortiWeb administrator account.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  10. (Optional) If the FortiWeb management interface uses a certificate signed by a trusted certificate authority (CA), enable Verify TLS Certificate. It's disabled by default, because FortiWeb appliances commonly use self-signed management certificates. When it's disabled, Certificate Manager - SaaS doesn't verify the server certificate, but the connection is still encrypted.

  11. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can reach the FortiWeb REST API and that the FortiWeb accepts the credentials. It doesn't check the account's certificate, policy, or system permissions.

  12. (Optional) For Discovery Types, select the kinds of certificates to discover. If you don't select any, discovery finds every type, including on scheduled runs.

    • Management Interface: the certificate of the management interface.
    • Server Policy Certificates: certificates that a server policy uses.
    • SNI Certificates: certificates that a member of an SNI group uses.
    • CA Certificates: this type doesn't currently match any certificate, because discovery reads only the local certificate store.
    • Unbound Certificates: local certificates that no server policy or SNI group uses.

  13. (Optional) For ADOM (leave blank to discover all), choose an ADOM to discover only that ADOM. If you leave it empty, discovery scans every ADOM the account can access. If ADOMs aren't enabled on the appliance, discovery scans the global scope and ignores this setting.

    Note

    Each ADOM has its own certificate store. Certificates with the same name in different ADOMs are tracked as separate installations.

  14. (Optional) To skip certificates that have already expired, enable Exclude expired certificates.

    Discovery skips the FortiWeb built-in default certificates. If discovery can't read an ADOM's certificate store, it skips that ADOM and continues with the next one.

  15. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  16. Click Continue. The Provisioning step opens.

  17. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  18. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on your FortiWeb.