FortiGate identity stored in TPM

Each FortiGate has a factory certificate (Fortinet_Factory) and backup certificate (Fortinet_Factory_Backup) that are signed by Fortinet’s CA and embedded in the hardware during production. Each factory certificate is unique and identifies the individual FortiGate. These certificates can be found in the GUI under System > Certificates under Local Certificate.

While this certificate is used in various settings by default, and can be used for various purposes as a local certificate that identifies this FortiGate, the primary purpose is to prove the FortiGate’s identity within SSL connections (TLS 1.3) to Fortinet services. These services include Security Fabric connections, FortiAnalyzer, FortiManager, and FortiGuard services.

In this enhancement, the private key for FortiGate’s factory certificate, in other words its identity, is seeded from its Trusted Platform Module (TPM) and stored on the TPM during the production process. The factory certificate is signed by our trusted CA and imported back to the FortiGate . The private key never leaves the FortiGate’s TPM and is not exposed to attackers. Attackers are unable to obtain this identity to spoof the FortiGate.

Scope and limitations

• FGT-200G is the first NPI model to use this new feature.

• The new Fortinet_Factory/Fortinet_Factory_Backup is restricted from being used for SSL offload, deep inspection, IPsec VPN, SSL VPN, Captive portal, and other purposes

  For example, the factory certificate cannot be configured under user.setting.auth-cert. Hence, the default certificate is replaced with "Fortinet_Default_SSL".

  config user setting
      set auth-cert “Fortinet_Default_SSL”
  end
  

• The certificate is intended and optimized for TLS 1.3 SSL connections to Fortinet services.