Creating a local certificate group
Local certificate groups are used to facilitate the configuration of profiles that are associated with a virtual server.
Before you begin, you must:
- Have Read-Write permission for System settings.
- Have already added the certificates to the local certificate store and intermediate CAs to the intermediate certificate store, and created an intermediate CA group.
- Optionally, create an OCSP Stapling configuration.
To create a local certificate group:
- Go to System > Certificate > Manage Certificates.
- Click Create New to display the configuration editor.
- Enter the Group Name. Valid characters are
-. No spaces. The maximum length is 35 characters. After you initially save the configuration, you cannot edit the name.
- Click Save.
- To add Group Members to a Local Certificate Group, double-click the group or click the (edit) icon in the row of the group that you want to modify.
- Click Create New.
- Complete the configuration as described in Local certificate group configuration.
- Click Save.
The configuration page displays the Local Certificate Group tab.
Check this check box only if you want to make this local certificate the default for the group.
Note: Only one local certificate can be set as the default in a group. If one local certificate has already been set as the default, you must disable (uncheck) it in order to set another one as the default. By default, the first local certificate in the group becomes the default if no other local certificate is set as the default.
|Local Certificate||Select a local certificate to add to the group.|
|OCSP Stapling||Select an OCSP Stapling configuration. The local certificate in the OCSP Stapling configuration must match the local certificate in the local certificate group member. See OCSP stapling.|
|Intermediate CA group||Select an intermediate CA group to add to the local group. (Optional)|
FortiADC supports dual SSL certificates, one for an RSA-based SSL certificate and the other for an ECDSA-based SSL certificate. This option allows you to add an additional local certificate along with an additional OCSP stapling and intermediate CA group to a local certificate group configuration.
Note: This extra local certificate, which is optional, must be of a different format from the local certificate you selected in the first place. In other words, if the local certificate is RSA-based, then this extra local certificate must be ECDSA-based, or vice versa.
|Extra Local Certificate||
Select an extra local certificate which is different from the local certificate.
|Extra OCSP Stapling||
Select an extra OCSP stapling configuration. The extra local certificate in the extra OCSP stapling configuration must match the extra local certificate in the extra local certificate group member. (Optional)
Note: This option is available only when the Extra Local Certificate has already been set.
|Extra Intermediate CA Group||
Select an extra intermediate CA group to add to the extra local certificate group. (Optional)
Note: This option is available only when the Extra Local Certificate is set.
Note: In general, ECDSA certificates are a good choice for both client and server because they require less time and fewer resources to process. However, for some old web browsers that do not support ECSDA certificates, RSA is the only choice. So, having both an RSA certificate and an ECSDA certificate in the same local certificate group configuration allows FortiADC to take full advantage of the benefits that they offer.
You can also assign two certificates to a local certificate group from the Console, as illustrated in the following example commands:
config system certificate local_cert_group
set local-cert intermediate02-leafCA-leaf-Serve-RSA
set OCSP-stapling intermediate02-leafCA-leaf-Serve-RSA
set intermediate-ca-group RSA-intermediate02-leaf
set local-cert-extra intermediate02-leafCA-leaf-Serve-ECC
set OCSP-stapling-extra intermediate02-leafCA-leaf-Serve-ECC
set intermediate-ca-group-extra RSA-intermediate02-leaf