Provision certificates to Fortinet FortiGate¶

Provision a certificate from Certificate Manager - SaaS to a virtual domain (VDOM) on a Fortinet FortiGate firewall, and bind it to the service that uses it. Certificate Manager - SaaS installs the certificate in the VDOM's certificate store, uploads its issuing chain, and then applies the binding you choose.

To provision a certificate to Fortinet FortiGate¶

1. Sign in to Certificate Manager - SaaS.
2. Click Installations > Machines.
3. Click the more options button at the end of the machine's row, and then select Provision.

4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

   The rest of the Provision a certificate dialog appears after you select a certificate.

5. Under Certificate Information, in VDOM, enter the name of the VDOM where you want to install the certificate, for example root. Each VDOM has its own certificate store. Enter a VDOM even if the device has only one.

6. In Certificate Name, enter the name for the certificate on FortiGate.

   Certificate Manager - SaaS adjusts the name to fit FortiGate rules. It replaces spaces with underscores, removes accents and any character other than a letter, number, underscore, or hyphen, and shortens the name to 35 characters.

   For a Local Certificate, if the same certificate is already in the VDOM under any name, Certificate Manager - SaaS uses that name and doesn't import the certificate again. If a different certificate already has the name, Certificate Manager - SaaS adds the date (UTC) and the last four hexadecimal digits of the serial number, for example webserver_26Oct30_3F2A, and shortens the base name if needed to stay within 35 characters. When it renews a certificate that already has such a suffix, Certificate Manager - SaaS replaces the suffix instead of adding another one.

7. For Certificate Type, choose how FortiGate stores the certificate:

   • Local Certificate installs the certificate with its private key. Choose it for the Management Interface (HTTPS Admin), SSL VPN Server Certificate, VIP HTTPS Listener, IPsec Tunnel Identity, and SSL Inspection: Protecting SSL Server bindings.
   • CA Certificate imports the certificate into the VDOM's CA certificate store without its private key. Choose it with Trust Anchor (CA) or Unbound Certificate. Binding a CA certificate to any other binding type fails.

8. Under Installation Endpoint, for Binding Type, choose where FortiGate uses the certificate:

   • Management Interface (HTTPS Admin) sets the certificate for HTTPS administration. This setting applies to the whole device, not to one VDOM.
   • SSL VPN Server Certificate sets the server certificate of the SSL VPN in the VDOM.
   • VIP HTTPS Listener adds the certificate to the certificate list of an existing VIP.
   • IPsec Tunnel Identity adds the certificate to the certificate list of an existing IPsec tunnel. A tunnel holds at most four certificates.
   • SSL Deep Inspection CA is for discovered certificates only. Provisioning to it from this dialog fails, because an inspection profile needs a re-signing CA with a private key that Certificate Manager - SaaS can't upload.
   • SSL Inspection: Protecting SSL Server adds the certificate to the server certificate list of an existing SSL/SSH inspection profile in Protecting SSL Server mode. If the profile is in another mode, provisioning fails.
   • Trust Anchor (CA) installs the certificate without binding it. Use it with CA Certificate.
   • Unbound Certificate installs the certificate without binding it.

   Note

   A VIP, an IPsec tunnel, or a Protecting SSL Server profile can hold several certificates, for example for different servers or key types. Certificate Manager - SaaS replaces only the certificates on the list that share a DNS name and the key type with the new certificate, and keeps the others. If no certificate on the list matches, Certificate Manager - SaaS adds the new certificate to the list. If that would put more than four certificates on an IPsec tunnel, provisioning fails and nothing changes.

9. In VDOM, enter the VDOM that holds the SSL VPN settings, the VIP, the IPsec tunnel, or the SSL/SSH profile. This is normally the VDOM you entered under Certificate Information, because that's where the certificate is installed. For Management Interface (HTTPS Admin), the setting is device-wide and this value isn't used.

10. If you chose VIP HTTPS Listener, IPsec Tunnel Identity, or SSL Inspection: Protecting SSL Server, in Resource Name, replace none with the name of the existing VIP, IPsec tunnel, or SSL/SSH profile, exactly as it appears on FortiGate.

11. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

12. Click Save. To save and then provision another certificate, click Save & New.

After you save, an installation appears on the machine's Installations tab. For a Local Certificate, Certificate Manager - SaaS also uploads the CA certificates of the issuing chain to the VDOM. If one can't be uploaded, provisioning still succeeds. For a VIP, IPsec tunnel, or SSL/SSH profile binding, Certificate Manager - SaaS reads the object back and fails the provisioning if FortiGate didn't accept the certificate. Certificate Manager - SaaS doesn't delete the certificate that a binding used before, so remove old certificates from FortiGate when you no longer need them. To provision on a schedule instead of right away, set up a machine provisioning schedule.