Provision certificates to Fortinet FortiWeb¶

Provision a certificate from Certificate Manager - SaaS to a Fortinet FortiWeb Web Application Firewall (WAF) for the management interface, a server policy, a Server Name Indication (SNI) domain, or the certificate store.

To provision a certificate to Fortinet FortiWeb¶

1. Sign in to Certificate Manager - SaaS.
2. Click Installations > Machines.
3. Click the more options button at the end of the machine's row, and then select Provision.

4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

   The rest of the Provision a certificate dialog appears after you select a certificate.

5. Under Certificate Information, in Certificate Name, enter a unique name for the certificate as you want it to appear on the FortiWeb.

   If the name is already in use in the ADOM, Certificate Manager - SaaS makes it unique by appending the current date and the last four hexadecimal characters of the certificate's serial number, for example web_cert_26Oct30_3A7F.

   Note

   FortiWeb certificate names can contain letters, digits, underscores, and hyphens, up to 35 characters. Certificate Manager - SaaS replaces spaces with underscores, removes other characters, and shortens longer names to 35 characters.

6. For Certificate Type, leave the default, Local (Server Certificate). This type is for server certificates that server policies, SNI bindings, or the management interface use for Transport Layer Security (TLS) termination. The CA (Certificate Authority) and Intermediate CA options describe discovered certificates. Provisioning ignores them and always imports the certificate as a local certificate.

7. (Optional) For ADOM (Administrative Domain), choose the administrative domain (ADOM) to provision the certificate to. Leave it empty for global (single-domain) mode.

   Note

   In a multi-ADOM environment, each ADOM has its own certificate store. Choose the ADOM that contains the server policy or SNI group you want to bind the certificate to.

8. Under Installation Endpoint, for Binding Type, choose where the FortiWeb uses the certificate:

   • Management Interface (Admin HTTPS): the FortiWeb management interface (admin web interface and REST API).
   • Server Policy (Reverse Proxy): TLS termination on a reverse-proxy server policy.
   • SNI Certificate: a per-domain certificate in an SNI group, for hosting several domains on one virtual server.
   • CA Certificate: uploads the certificate without binding it, the same as Unbound (Not Assigned).
   • Unbound (Not Assigned): uploads the certificate to the FortiWeb certificate store without binding it to a policy or service.

9. If you chose Server Policy (Reverse Proxy), for Server Policy, choose the server policy that uses the certificate for TLS termination. The list shows the server policies in the selected ADOM.

10. If you chose SNI Certificate, for SNI Group, choose the SNI group that contains the domain. The list shows the SNI groups in the selected ADOM.

11. If you chose SNI Certificate, in SNI Domain Name, enter the exact domain name of the SNI group member to update. The domain must already be a member of the SNI group. Certificate Manager - SaaS updates the existing member and doesn't add one.

    Warning

    Updating the member also resets its settings. Certificate Manager - SaaS sets the member's domain-type to plain, multi-local-cert to disable, and certificate-type to disable. A member that used a wildcard or regular-expression domain type, or more than one local certificate, loses those settings.

12. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

13. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS uploads the certificate, its intermediate certificates, and its private key to the local certificate store of the selected ADOM, and then updates the binding to use the new certificate. For Management Interface (Admin HTTPS), it sets the appliance's global https-certificate setting. An installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.