Certificate Rekeying During Re-enrollment

Previously, the FortiOS EST protocol implementation reused the same private key for certificate renewal. Starting with version 7.4.6, FortiOS allows certificates generated through the EST protocol to undergo a rekey process during re-enrollment, enhancing security and flexibility.

A new option has been added to specify whether to use an existing key or generate a new one, with the default now set to create a new one.

config vpn certificate local
    edit <name>
        set est-regeneration-method {create-new-key | use-existing-key}
    next
end

The BIOS security level is updated from levels 0/1/2 to levels Low and High. Level High will correspond to previous behaviors in level 2, and level Low will correspond to behaviors in level 1. BIOS that still uses levels 0 will now behave like level 1/Low.