CA certificate

You must import the Active Directory (AD) certificate authority (CA) certificate into the FortiGate for the FortiGate to verify the chain of trust for the client certificate and the LDAPS connection.

To import the CA certificate:

1. In the Certification Authority manager, right-click your domain, then select Properties.
2. On the General tab, click View Certificate.

   

3. On the Details tab, click Copy to File...
4. Follow the wizard to save the file as a Base-64 encoded X.509 (.CER).
5. In FortiOS, import the certificate:
   1. Go to System > Certificates.
   2. Click Create/Import > CA Certificate.
   3. For Type, select File.
   4. Click Upload.
   5. Select the previously saved CA certificate.
   6. Click OK.
   7. Once imported, run the following CLI commands to rename the certificate for easier recognition:

      config vpn certificate ca

      rename CA_Cert_1 to FortiAD.Info

      end

6. In System > Certificates, view the imported certificate under Remote CA Certificate.

   

Additionally, the root CA may have also issued a server certificate for the SSL VPN portal access. If so, you must import this server certificate on the FortiGate. In this example, a wildcard certificate for *.ztnademo.com was issued and installed on the FortiGate as the screenshot demonstrates.

Furthermore, you must install the CA certificate on the endpoint computer to verify the connection security with the SSL VPN gateway. You should install the CA certificate to Local Computer\Trusted Root Certification Authority\Certificates.