Importing intermediate CAs

An intermediate CA store is for the intermediate CA certificates that back-end servers would normally use to complete the chain of server certificates, if any. HTTPS transactions use intermediate CAs when the server certificate is signed by an intermediate certificate authority (CA) rather than a root CA.

In FortiADC, a root CA can be imported as an "intermediate CA".

Before you begin, you must:

• Have Read-Write permission for System settings.
• Know the URL of an SCEP server or have downloaded the certificate and key files and be able to browse to them so that you can upload them.

To import an intermediate CA:

1. Go to System > Certificate > Manage Certificates.
2. Click the Intermediate CA tab.
3. Click Import to display the configuration editor.
4. Complete the configuration as described in Intermediate CA import configuration.
5. Click Save when done.
6. Repeat Steps 3 through 5 to import as many intermediate CAs as needed.

Intermediate CA import configuration

Settings	Guidelines
Certificate Name	Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.The maximum length is 35 characters. After you initially save the configuration, you cannot edit the name.
Import Method	SCEP—Use Simple Certificate Enrollment Protocol. SCEP allows routers and other intermediary network devices to obtain certificates. File—Upload a file.
SCEP
SCEP URL	Specify the URL of the SCEP Server.
CA Identifier	Enter the identifier of the CA on the SCEP server, if applicable.
File
Certificate File	Browse for and upload the the certificate file on the local machine.
Key File	Browse for the corresponding PEM key file that you want to upload. Note: Both a certificate file and key file are required for the intermediate CA used in SSL decryption by the forward proxy.
Password	Password to encrypt the files in local storage.