Certificates

This section contains topics about uploading certificates and provides examples of how certificates may be used to encrypt and decrypt communications, and represent the identity of the FortiGate. This sections assumes that you have a high level understanding of the public key infrastructure (PKI) system, particularly how entities leverage trusted certificate authorities (CAs) to verify the authenticating party, and how public and private certificate keys work to secure communications.

The certificates feature is hidden by default in FortiOS. In the GUI, go to System > Feature Visibility and enable Certificates.

Common certificate uses in FortiOS

Type	How to generate/import certificate	FortiGate Use Examples	Private Key1
Local Certificate	ACME, Self Sign, CSR, File Upload (PKCS #12 & CER+PEM)	Client certificates: Site-to-Site VPN Dialup SSL VPN Dialup IPsec VPN Server certificates: HTTPS admin access Protecting an SSL Server	Yes
Remote Certificate	File Upload	SAML SP: Security Fabric > Fabric Connectors > Security Fabric Setup > Advanced Options > SP certificate IdP: Security Fabric > Fabric Connectors > Security Fabric Setup > Edit/create a SP > IdP certificate	No
Local CA (and sub-CA)	Online SCEP, File Upload	SSL Inspection Multiple Clients Connecting to Multiple Servers Security Profiles > SSL/SSH Inspection > profile_name > CA certificate	Yes
Remote CA	Online SCEP, File Upload	Enable FortiGate to trust certificates signed by the remote CA. Example uses: LDAPS connection User authentication (policy & admin access) FortiAnalyzer OFTP tunnel	No

¹Certificates with a private key are uploaded in the following common formats:

• Certificate and private key in one file (PKCS #12)

  • .PFX

• Certificate and private key in separate files

  • Certificate: .CER, .DER

  • Key: .PEM

• When using Certificate Signing Request (CSR), the private key remains on the FortiGate and the signed CSR is returned to the FortiGate to complete the cert+key pair.

  • .CER

  See Import a certificate for more details.

For additional capabilities and enhanced certificate management, please review the FortiAuthenticator Administration Guide and Examples. FortiManager can integrate with FortiAuthenticator to provide large scale FortiGate certificate deployment and management; see FortiManager Examples.

The following topics provide information about certificates:

• Automatically provision a certificate

• Generate a new certificate

• Regenerate default certificates

• Import a certificate

• Generate a CSR

• CA certificate

• Remote certificate

• Certificate revocation list

• Export a certificate

• Uploading certificates using an API

• Enrollment over Secure Transport for automatic certificate management

The following topics provide examples of how to use certificates: