Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiManager 7.0.7 Administration Guide
    7.0.7
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.6
    6.2.5
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.0.12
    6.0.11
    6.0.10
    6.0.9
    6.0.8
    6.0.7
    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0
    5.6.11
    5.6.10
    5.6.9
    5.6.8
    5.6.7
    5.6.6
    5.6.5
    5.6.4
    5.6.3
    5.6.2
    5.6.1
    5.6.0
    5.4.7
    5.4.6
    5.4.5
    5.4.4
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.2.10
    5.2.7
    5.2.6
    5.2.4
    5.2.3
    5.2.2
    5.2.1
    5.2.0
    5.0.12
    5.0.11
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    4.3.8
    4.3.7
    4.3.6
    4.3.5
    4.3.4
    4.3.3
    4.3.2
    4.3.1
    4.3.0
    4.2.9
    4.2.8
    4.2.7
    4.2.6
    4.2.5
    4.2.4
    4.2.3
    4.2.2
    4.2.1
    4.2.0
    4.1.0
    4.0.3
    4.0.2
    4.0.1
    4.0.0

    Certificate templates

    Certificate templates

    The certificate templates menu allows you to create certificate templates for an external certificate authority (CA) or the local FortiManager CA.

    FortiManager includes a certificate authority server for each ADOM. When you create an ADOM, the private and public key pair is created for the ADOM. The key pair is automatically used when you use FortiManager to define IPsec VPNs or SSL-VPNs for a device.

    When you add a device to an IPsec VPN or SSL-VPN topology with a certificate template that uses the FortiManager CA, the local FortiManager CA is automatically used. No request for a pre-shared key (PSK) is generated. When the IPsec VPN or SSL-VPN topology is installed to the device, the following process completes automatically:

    • The FortiGate device generates a certificate signing request (CSR) file.
    • FortiManager signs the CSR file and installs the CSR file on the FortiGate device.
    • The CA certificate with public key is installed on the FortiGate device.

    Some settings may not be available in all ADOM versions.

    The following options are available:

    Create New

    Create a new certificate template.

    Edit

    Edit a certificate template. Right-click a certificate template, and select Edit.

    Delete

    Delete a certificate template. Right-click a certificate template, and select Delete.

    Generate

    Create a new certificate from a device.
    To create a new certificate template:
    1. Go to Device Manager > Provisioning Templates > Certificate Templates.
    2. Click Create New. The Create New Certificate Template pane opens.
    3. Enter the following information, then click OK to create the certificate template:

      Type

      Specify whether the certificate uses an external or local certificate authority (CA).

      When you select External, you must specify details about online SCEP enrollment.

      When you select Local, you are using the FortiManager CA server.

      Certificate Name

      Type a name for the certificate.

      Optional Information

      Optionally, type the organization unit, organization, locality (city), province or state, country or region, and email address.

      Key Type

      RSA is the default key type. This field cannot be edited.

      Key Size

      Select the key size from the dropdown list: 512 bit, 1024 bit, 1536 bit, or 2048 bit.

      Online SCEP Enrollment

      These options are only available when the certificate type is External.

      CA Server URL

      Type the server URL for the external CA.

      Challenge Password

      Type the challenge password for the external CA server.

    To edit a certificate template:
    1. Select a certificate template, and click Edit.
    2. Edit the settings as required in the Edit Certificate Template pane, and click OK.
    To delete a certificate template:
    1. Select a certificate template, and click Delete.
    2. Click OK in the confirmation dialog box.
    Previous
    Next

    Certificate templates

    Certificate templates

    The certificate templates menu allows you to create certificate templates for an external certificate authority (CA) or the local FortiManager CA.

    FortiManager includes a certificate authority server for each ADOM. When you create an ADOM, the private and public key pair is created for the ADOM. The key pair is automatically used when you use FortiManager to define IPsec VPNs or SSL-VPNs for a device.

    When you add a device to an IPsec VPN or SSL-VPN topology with a certificate template that uses the FortiManager CA, the local FortiManager CA is automatically used. No request for a pre-shared key (PSK) is generated. When the IPsec VPN or SSL-VPN topology is installed to the device, the following process completes automatically:

    • The FortiGate device generates a certificate signing request (CSR) file.
    • FortiManager signs the CSR file and installs the CSR file on the FortiGate device.
    • The CA certificate with public key is installed on the FortiGate device.

    Some settings may not be available in all ADOM versions.

    The following options are available:

    Create New

    Create a new certificate template.

    Edit

    Edit a certificate template. Right-click a certificate template, and select Edit.

    Delete

    Delete a certificate template. Right-click a certificate template, and select Delete.

    Generate

    Create a new certificate from a device.
    To create a new certificate template:
    1. Go to Device Manager > Provisioning Templates > Certificate Templates.
    2. Click Create New. The Create New Certificate Template pane opens.
    3. Enter the following information, then click OK to create the certificate template:

      Type

      Specify whether the certificate uses an external or local certificate authority (CA).

      When you select External, you must specify details about online SCEP enrollment.

      When you select Local, you are using the FortiManager CA server.

      Certificate Name

      Type a name for the certificate.

      Optional Information

      Optionally, type the organization unit, organization, locality (city), province or state, country or region, and email address.

      Key Type

      RSA is the default key type. This field cannot be edited.

      Key Size

      Select the key size from the dropdown list: 512 bit, 1024 bit, 1536 bit, or 2048 bit.

      Online SCEP Enrollment

      These options are only available when the certificate type is External.

      CA Server URL

      Type the server URL for the external CA.

      Challenge Password

      Type the challenge password for the external CA server.

    To edit a certificate template:
    1. Select a certificate template, and click Edit.
    2. Edit the settings as required in the Edit Certificate Template pane, and click OK.
    To delete a certificate template:
    1. Select a certificate template, and click Delete.
    2. Click OK in the confirmation dialog box.
    Previous
    Next