Fortinet FortiADC¶

Certificate Manager - SaaS installs a certificate into a local certificate group that already exists on the FortiADC. Client SSL profiles reference the group, and virtual servers reference the profiles, so every virtual server that uses the group serves the new certificate. Certificate Manager - SaaS doesn't create or change local certificate groups, client SSL profiles, or virtual servers. Create them on the appliance before you provision.

Click Installations > Machines.
Click the more options button at the right end of the FortiADC machine's row, and then select Provision.
From the Search a certificate by name, expiration, or fingerprint field, begin typing the certificate name you want to provision. Click the certificate when it appears in the list.
Under Certificate Information, in Certificate Name, choose what the certificate replaces:
- To add the certificate to the group as a new entry, leave the default, (none).
- To replace a certificate that's already in the group, enter that certificate's name on the FortiADC.
Certificate Manager - SaaS uploads the certificate under a name it generates from the certificate's common name and fingerprint, such as www-example-com-1a2b3c4d5e6f, and updates this field with that name.
In Virtual Domain, enter the virtual domain that holds the local certificate group. Leave the default, global, if virtual domains are turned off on the appliance.
In Local Certificate Group, enter the name of the local certificate group that serves the certificate. The group must already exist.
Leave Intermediate CA Group as it is. When Certificate Manager - SaaS installs the certificate, it uploads the certificate's chain into an intermediate CA group that it creates for the certificate, named after the certificate with -chain added, and fills in this field. If the certificate has no chain, Certificate Manager - SaaS keeps the intermediate CA group the replaced certificate used.
Under Server Store Details, for Binding Type, choose the type that matches how the appliance uses the local certificate group:
- Virtual Server (default): a virtual server uses a client SSL profile that uses the group.
- Client SSL Profile: a client SSL profile uses the group, but no virtual server uses the profile.
- Unbound: nothing uses the group yet.
Discovery reports this type for the group. If you choose a different type, provisioning still works, but the next discovery adds a second installation for the same certificate.

Certificate Manager - SaaS doesn't bind anything for any type. It checks that the virtual server or client SSL profile you enter exists and uses the local certificate group.

Note

Discovery can't read a certificate that no enabled virtual server serves. It won't find Unbound installations, or Client SSL Profile installations whose profile no enabled virtual server uses.
Enter the details for the binding type you chose:
- If you chose Virtual Server:
  - In Virtual Server, enter the name of the virtual server.
  - In Virtual Server Port, leave the default, (none), or enter a port the virtual server listens on. Certificate Manager - SaaS checks that the virtual server listens on the port. A different port doesn't create a second installation.
  - (Optional) In Client SSL Profile, enter the client SSL profile the virtual server uses.
- If you chose Client SSL Profile, in Client SSL Profile, enter the name of the client SSL profile.
To save without pushing the certificate, disable Push certificate on save.
Click Save.

Tip

You can schedule your provisions daily, weekly, or monthly. See Set up a machine provisioning schedule.

After you save, Certificate Manager - SaaS uploads the certificate, its private key, and its chain to the FortiADC. It then points the local certificate group at the new certificate. If the group was empty, the certificate becomes the group's default. If the group already has entries, the certificate doesn't replace the default. The FortiADC serves it only to clients that request its hostname through Server Name Indication (SNI). An installation appears on the Installations tab.

How renewal works¶

When you renew a certificate, Certificate Manager - SaaS uploads the renewed certificate under a new name and points the same entry in the local certificate group at it. You don't need to rebind anything, and live traffic isn't interrupted. The installation's Certificate Name changes to the new name.

When the renewed certificate is provisioned, the event log shows these events: Machine Installation Provisioning Started, Certificate Installed, Machine Installation Updated, and Machine Installation Provisioning Finished.

Certificate Manager - SaaS doesn't delete the replaced certificate or its intermediate CA group from the appliance. Remove them on the FortiADC when you no longer need them.

Pushing a certificate that's already installed changes nothing on the appliance.

A group entry can hold one RSA certificate and one ECDSA certificate. Renewing one of them leaves the other in place.

What Certificate Manager - SaaS doesn't manage¶

Certificates for backend SSL connections to real servers.
CA certificates that validate client certificates, and the appliance's own management certificate.
Creating local certificate groups, client SSL profiles, or virtual servers.
Removing replaced certificates and intermediate CA groups.

Troubleshooting¶

An error in Certificate Manager - SaaS starts with what Certificate Manager - SaaS was doing and ends with the reason from the FortiADC, for example: could not upload local certificate "www-example-com-1a2b3c4d5e6f": POST /api/upload/certificate_local failed: appliance error -37: Permission denied. The headings below quote the part of the message to look for.

Certificate Manager - SaaS uploads the certificate before it checks the installation's local certificate group, client SSL profile, and virtual server. If one of those checks fails, the certificate stays on the FortiADC. After you fix the installation, push the certificate again. Certificate Manager - SaaS reuses the certificate it already uploaded instead of uploading a copy.

Provisioning fails with "local certificate group … not found in VDOM …"

The Local Certificate Group doesn't exist in the Virtual Domain you entered. Certificate Manager - SaaS doesn't create groups. Create the group on the FortiADC, or correct the name or virtual domain, and then push the certificate again.

Provisioning fails with "client SSL profile … not found" or "virtual server … not found"

The client SSL profile or virtual server doesn't exist in the Virtual Domain you entered. Correct the name, or create the object on the FortiADC.

Provisioning fails with "client SSL profile … uses local certificate group …, not …"

The client SSL profile, or the profile the virtual server uses, references a different local certificate group from the one in the installation. Change the installation's Local Certificate Group, or point the profile at the group on the FortiADC.

Provisioning fails with "virtual server … does not listen on port …"

The Virtual Server Port isn't one of the virtual server's ports. The message lists the ports it listens on. Enter one of them, or set the field back to (none).

Provisioning fails with "virtual server … has no client SSL profile, so it serves no certificate"

The virtual server doesn't use a client SSL profile, so it can't serve the certificate. On the FortiADC, assign the virtual server a client SSL profile that uses the local certificate group, or change the installation's Binding Type.

Provisioning fails with "virtual server … uses client SSL profile …, not …"

The Client SSL Profile you entered isn't the profile the virtual server uses. Enter the virtual server's profile, or leave the field empty.

Provisioning fails with "local certificate group … in VDOM … does not hold certificate …"

Certificate Manager - SaaS installed the certificate, but when it checked the binding, the group no longer held it. This usually means someone changed the group on the FortiADC during provisioning, for example by removing or replacing the certificate. Check the group, and then push the certificate again.

Provisioning fails with "the appliance already holds a different certificate named …"

A different certificate on the FortiADC already has the name Certificate Manager - SaaS generated for this one. Rename or delete that certificate on the appliance, and push the certificate again.

Provisioning fails with "Permission denied."

The REST API administrator account's access profile doesn't have read-write access to System and read access to Server Load Balance. See Prepare the FortiADC.

Provisioning fails because the new certificate "clashes with the … certificate already in the other slot"

Each group entry holds at most one RSA certificate and one ECDSA certificate. The entry already has a certificate with the same key type in its other slot.

A renewal added a new entry to the group instead of replacing the certificate

The certificate in Certificate Name was renamed, replaced, or removed from the group on the FortiADC. Certificate Manager - SaaS adds the renewed certificate as a new entry and logs a warning in the connector log on the VSatellite. The other entries in the group don't change.

Discovery fails with "virtual domains are disabled on the appliance …"

Virtual Domains lists a virtual domain other than global, but virtual domains are turned off on the FortiADC. The message names the entries to remove. Remove them, or leave Virtual Domains empty.

Discovery fails with "virtual domains … not found on the appliance"

A name in Virtual Domains doesn't match a virtual domain on the FortiADC. Correct or remove it.

Discovery fails with "the API account cannot list the virtual domains …"

Virtual domains are turned on, Virtual Domains is empty, and the API account isn't a global administrator. Only a global administrator can list virtual domains. List the account's virtual domains under Virtual Domains, or use a global administrator account. See Prepare the FortiADC.

A certificate on the appliance isn't discovered

No enabled virtual server serves the certificate, or the VSatellite can't reach the address and port of the virtual server that serves it. The connector log on the VSatellite lists skipped certificates by name.