EMS distributes SSL deep inspection CA certificates 7.0.1

FortiGate can push certificate authority (CA) certificates directly to EMS once it establishes communication with EMS. You no longer have to manually import CA certificates from FortiGate to EMS.

The following instructions assume that FortiGate, EMS, and a FortiClient (Windows) endpoint are already operating as components of a Fortinet Security Fabric. FortiClient is connected to EMS.

To configure EMS to distribute FortiGate CA certificates to FortiClient endpoints:

1. Create an EMS Fabric connector in FortiOS:
   1. In FortiOS, go to Security Fabric > Fabric Connectors.
   2. Click Create New.
   3. Create a new Fabric connector for EMS.

      

2. Configure EMS to import the certificates:
   1. In EMS, go to Administration > Fabric Devices.
   2. Authorize the connection request from the FortiGate.
   3. Once the connection succeeds, EMS automatically imports FortiGate CA certificates. To verify this, go to Endpoint Policy & Components > CA Certificates. This pane lists certificates under the FortiGate serial number.

      

3. Go to Endpoint Profiles > Manage Profiles.
4. Select the profile that is applied to the endpoint.
5. On the System Settings tab, enable Install CA Certificate on Client. Once enabled, the field displays the imported FortiGate certificates. Select the desired certificates to distribute to the endpoints.
6. Click Save.
7. After the endpoint receives the profile updates from EMS, open the Manage Computer certificates/Manage User certificates console on the endpoint.
8. Go to Trusted Root Certification Authorities > Certificates.
9. Confirm that the selected certificates are installed.