Managing certificates
This section explains how to manage X.509 security certificates using the FortiMail web UI. Using the Certificate submenu, you can generate certificate requests, install signed certificates, import CA root certificates and certificate revocation lists, and back up and restore installed certificates and private keys.
FortiMail uses certificates for PKI authentication in secure connections. PKI authentication is the process of determining if a remote host can be trusted with access to network resources. To establish its trustworthiness, the remote host must provide an acceptable authentication certificate by obtaining a certificate from a certification authority (CA).
You can manage the following types of certificates on FortiMail:
Certificate types
|
Certificate type |
Usage |
|---|---|
|
CA certificates |
FortiMail uses CA certificates to authenticate the PKI users, including administrators and web mail users. For details, see Configuring PKI authentication and Managing certificate authority certificates. |
|
Server certificates |
FortiMail must present its local server certificate for the following secure connections:
For details, see Managing local certificates. |
|
Personal certificates |
Mail users’ personal certificates are used for S/MIME encryption. For details, see Configuring certificate bindings. |
For an example of how to use certificates for PKI authentication of FortiMail administrators and email users, see the PKI authentication appendix in the FortiMail Administration Guide.
This section contains the following topics:
- Managing local certificates
- Managing certificate authority certificates
- Managing the certificate revocation list
- Managing OCSP server certificates
Managing local certificates
System > Certificate > Local Certificate displays both the signed server certificates and unsigned certificate requests.
On this tab, you can also generate certificate signing requests and import signed certificates in order to install them for local use by the FortiMail unit.
FortiMail units require a local server certificate that it can present when clients request secure connections, including:
- the web UI (HTTPS connections only)
- webmail (HTTPS connections only)
- secure email, such as SMTPS, IMAPS, and POP3S
To access this part of the web UI, your administrator account’s:
- Domain must be System
- access profile must have Read or Read-Write permission to the Others category
For details, see About administrator account permissions and domains.
To view local certificates
- Go to System > Certificate > Local Certificate.
|
GUI item |
Description |
|
(button) |
Select a certificate and click View to display its issuer, subject, and range of dates within which the certificate is valid. |
|
Delete (button) |
Removes the selected certificate. |
|
Generate (button) |
Click to generate a local certificate request. For more information, see Generating a certificate signing request. |
|
Download (button) |
Click the row of a certificate file or certificate request file in order to select it, then click this button to download a certificate (.cer) or certificate request (.csr) file. You can send the request to your certificate authority (CA) to obtain a signed certificate for the FortiMail unit. For more information, see Downloading a certificate signing request. |
|
Set status |
Click the row of a certificate in order to select it, then click this button to use it as the “default” (that is, currently chosen for use) certificate. The Status column changes to indicate that the certificate is the current (Default) certificate. This button is not available if the selected certificate is already the “default.” |
|
Import (button) |
Click to import a signed certificate for local use. For more information, see Importing a certificate. |
|
Name |
Displays the name of the certificate file or certificate request file. |
|
Subject |
Displays the Distinguished Name (DN) located in the If the certificate has not yet been signed, this field is empty. |
|
Status |
Displays the status of the local certificates or certificate signing request.
|
See also
Generating a certificate signing request
Downloading a certificate signing request
Obtaining and installing a local certificate
There are two methods to obtain and install a local certificate:
- If you already have a signed server certificate (a backup certificate, a certificate exported from other devices, and so on), you can import the certificate into FortiMail. For details, see Importing a certificate.
- Generate a certificate signing request on the FortiMail unit, get the request signed by a CA ,and import the signed certificate into FortiMail.
For the second method, follow these steps:
- Generating a certificate signing request
- Downloading a certificate signing request
- Submitting a certificate request to your CA for signing
- Importing a certificate
Generating a certificate signing request
You can generate a certificate request file, based on the information you enter to identify the FortiMail unit. Certificate request files can then be submitted for verification and signing by a certificate authority (CA).
For other related steps, see Obtaining and installing a local certificate.
To generate a certificate request
- Go to System > Certificate > Local Certificate.
- Click Generate.
- Configure the following:
- Host IP
- Domain name
- Host IP requires that the FortiMail unit have a static, public IP address. It may be preferable if clients will be accessing the FortiMail unit primarily by its IP address.
- Domain name requires that the FortiMail unit have a fully-qualified domain name (FQDN). It may be preferable if clients will be accessing the FortiMail unit primarily by its domain name.
- E-mail does not require either a static IP address or a domain name. It may be preferable if the FortiMail unit does not have a domain name or public IP address.
- Click OK.
A dialog appears.
|
GUI item |
Description |
|
|
Certification name |
Enter a unique name for the certificate request, such as |
|
|
Information that the certificate is required to contain in order to uniquely identify the FortiMail unit. |
||
|
|
Certification name |
Select which type of identifier will be used in the certificate to identify the FortiMail unit: Which type you should select varies by whether or not your FortiMail unit has a static IP address, a fully-qualified domain name (FQDN), and by the primary intended use of the certificate. For example, if your FortiMail unit has both a static IP address and a domain name, but you will primarily use the local certificate for HTTPS connections to the web UI by the domain name of the FortiMail unit, you might prefer to generate a certificate based on the domain name of the FortiMail unit, rather than its IP address. |
|
|
IP |
Enter the static IP address of the FortiMail unit. This option appears only if ID Type is Host IP. |
|
|
Domain name |
Type the fully-qualified domain name (FQDN) of the FortiMail unit. The domain name may resolve to either a static or, if the FortiMail unit is configured to use a dynamic DNS service, a dynamic IP address. For more information, see Configuring the network interfaces and Configuring dynamic DNS. If a domain name is not available and the FortiMail unit subscribes to a dynamic DNS service, an This option appears only if ID Type is Domain name. |
|
|
|
Type the email address of the owner of the FortiMail unit. This option appears only if ID type is E-mail. |
|
Optional Information |
Information that you may include in the certificate, but which is not required. |
|
|
|
Organization unit |
Type the name of your organizational unit, such as the name of your department (Optional). To enter more than one organizational unit name, click the + icon, and enter each organizational unit separately in each field. |
|
|
Organization |
Type the legal name of your organization (Optional). |
|
|
Locality(City) |
Type the name of the city or town where the FortiMail unit is located (Optional). |
|
|
State/Province |
Type the name of the state or province where the FortiMail unit is located (Optional). |
|
|
Country |
Select the name of the country where the FortiMail unit is located (Optional). |
|
|
|
Type an email address that may be used for contact purposes (Optional). |
|
Displays the type of algorithm used to generate the key. This option cannot be changed, but appears in order to indicate that only RSA is currently supported. |
||
|
Select a security key size of 512 Bit, 1024 Bit, 1536 Bit or 2048 Bit. Larger keys are slower to generate, but provide better security. |
||
The certificate is generated, and can be downloaded to your management computer for submission to a certificate authority (CA) for signing. For more information, see Downloading a certificate signing request.
Downloading a certificate signing request
After you have generated a certificate request, you can download the request file to your management computer in order to submit the request file to a certificate authority (CA) for signing.
For other related steps, see Obtaining and installing a local certificate.
To download a certificate request
- Go to System > Certificate > Local Certificate.
- Click the row that corresponds to the certificate request in order to select it.
- Click Download, then select Download from the pop-up menu.
Your web browser downloads the certificate request (.csr) file.
Submitting a certificate request to your CA for signing
After you have download the certificate request file, you can submit the request to you CA for signing.
For other related steps, see Obtaining and installing a local certificate.
To submit a certificate request
- Using the web browser on the management computer, browse to the web site for your CA.
- Follow your CA’s instructions to place a Base64-encoded PKCS #12 certificate request, uploading your certificate request.
- Follow your CA’s instructions to download their root certificate and Certificate Revocation List (CRL), and then install the root certificate and CRL on each remote client.
- When you receive the signed certificate from the CA, install the certificate on the FortiMail unit. For more information, see Importing a certificate.
See also
Generating a certificate signing request
Importing a certificate
|
DER encoding is not supported in FortiMail version 4.0 GA and MR1 releases. |
Importing a certificate may be useful when:
- restoring a certificate backup
- installing a certificate that has been generated on another system
- installing a certificate, after the certificate request has been generated on the FortiMail unit and signed by a certificate authority (CA)
If you generated the certificate request using the FortiMail unit, after you submit the certificate request to CA, the CA will verify the information and register the contact information in a digital certificate that contains a serial number, an expiration date, and the public key of the CA. The CA will then sign the certificate and return it to you for installation on the FortiMail unit. To install the certificate, you must import it. For other related steps, see Obtaining and installing a local certificate.
If the FortiMail unit’s local certificate is signed by an intermediate CA rather than a root CA, before clients will trust the FortiMail unit’s local certificate, you must demonstrate a link with trusted root CAs, thereby proving that the FortiMail unit’s certificate is genuine. You can demonstrate this chain of trust either by:
- installing each intermediate CA’s certificate in the client’s list of trusted CAs
- including a signing chain in the FortiMail unit’s local certificate
To include a signing chain, before importing the local certificate to the FortiMail unit, first open the FortiMail unit’s local certificate file in a plain text editor, append the certificate of each intermediate CA in order from the intermediate CA who signed the FortiMail unit’s certificate to the intermediate CA whose certificate was signed directly by a trusted root CA, then save the certificate. For example, a local certificate which includes a signing chain might use the following structure:
-----BEGIN CERTIFICATE-----
<FortiMail unit’s local server certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 1, who signed the FortiMail certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<certificate of intermediate CA 2, who signed the certificate of intermediate CA 1 and whose certificate was signed by a trusted root CA>
-----END CERTIFICATE-----
To import a local certificate
- Go to System > Certificate > Local Certificate.
- Click Import.
- Select the type of the import file or files:
- Local Certificate: Select this option if you are importing a signed certificate issued by your CA. For other related steps, see Obtaining and installing a local certificate.
- PKCS12 Certificate: Select this option if you are importing an existing certificate whose certificate file and private key are stored in a PKCS #12 (.p12) password-encrypted file.
- Certificate: Select this option if you are importing an existing certificate whose certificate file (.cert) and key file (.key) are stored separately. The private key is password-encrypted.
|
GUI item |
Description |
|
Certificate name |
Enter the location of the previously .cert or .pem exported certificate (or, for PKCS #12 certificates, the .p12 certificate-and-key file), or click Browse to locate the file. |
|
Key file |
Enter the location of the previously exported key file, or click Browse to locate the file. This option appears only when Type is Certificate. |
|
Password |
Enter the password that was used to encrypt the file, enabling the FortiMail unit to decrypt and install the certificate. This option appears only when Type is PKCS12 certificate or Certificate. |
See also
Downloading a certificate signing request
Managing certificate authority certificates
Go to System > Certificate > CA Certificate to view and import certificates for certificate authorities (CA).
Certificate authorities validate and sign other certificates in order to indicate to third parties that those other certificates may be trusted to be authentic.
CA certificates are required by connections that use transport layer security (TLS), and by S/MIME encryption. For more information, see Configuring TLS security profiles and Configuring certificate bindings. Depending on the configuration of each PKI user, CA certificates may also be required to authenticate PKI users. For more information, see Configuring PKI authentication.
To access this part of the web UI, your administrator account’s:
- Domain must be System
- access profile must have Read or Read-Write permission to the Others category
For details, see About administrator account permissions and domains.
To view a the list of CA certificates, go to System > Certificate > CA Certificate.
Managing CA certificates
See also
Managing certificate authority certificates
Managing OCSP server certificates
Managing the certificate revocation list
The Certificate Revocation List tab lets you view and import certificate revocation lists.
To ensure that your FortiMail unit validates only valid (not revoked) certificates, you should periodically upload a current certificate revocation list, which may be provided by certificate authorities (CA). Alternatively, you can use online certificate status protocol (OCSP) to query for certificate statuses. For more information, see Managing OCSP server certificates.
To access this part of the web UI, your administrator account’s:
- Domain must be System
- access profile must have Read or Read-Write permission to the Others category
For details, see About administrator account permissions and domains.
To view remote certificates, go to System > Certificate > Certificate Revocation List.
Managing certificate revocation lists
See also
Managing certificate authority certificates
Managing OCSP server certificates
Managing OCSP server certificates
Go to System > Certificate > Remote to view and import the certificates of the online certificate status protocol (OCSP) servers of your certificate authority (CA).
OCSP lets you revoke or validate certificates by query, rather than by importing certificate revocation lists (CRL). For information about importing CRLs, see Managing the certificate revocation list.
Remote certificates are required if you enable OCSP for PKI users. For more information, see Configuring PKI authentication.
To access this part of the web UI, your administrator account’s:
- Domain must be System
- access profile must have Read or Read-Write permission to the Others category
For details, see About administrator account permissions and domains.
To view a the list of remote certificates, go to System > Certificate > Remote.