Configuring FortiManager to deploy certificates for admin GUI access
The steps for deploying an end-entity certificate for admin GUI access are as follows:
Creating the certificate for administrator web access
When selecting a certificate to secure HTTPS access, there are a few options you may consider. This example utilizes a wildcard certificate so that it may be applied to several FortiGates in the same domain, such as FGT1.domain.com, FGT2.domain.com, etc.
This wildcard certificate is signed by the same CA used to sign the intermediate CA used by SSL/SSH inspection.
To create the certificate on FortiAuthenticator:
-
Navigate to Certificate Management > End Entities > Users.
-
Select + Create New.
-
Provide details for your FortiGate certificate.
-
Expand Advanced Options: Key Usages and add Server Authentication to the Chosen Extended Key Usages.
- Select OK to save the certificate.
- Select the generated certificate using the checkbox, and click Export Key and Cert.
- Provide a passphrase and click OK.
- Click Download PKCS#12 file to download the certificate.
Uploading the certificate to FortiManager
To upload the certificate to FortiManager:
-
Navigate to Policy & Objects > Advanced.
-
From the top menu bar, select Tools > Feature Visibility, and under Advanced enable Dynamic Local Certificate.
-
Select Dynamic Local Certificate from the top.
-
Select +Create New in the top left.
-
Specify a name for the certificate.
-
Expand Per-Device Mapping and select Create New to create a new mapping.
-
Select the target FortiGate for Mapped device.
-
Select Import next to Import Certificate.
-
Select Local Certificate for Type.
-
Upload the file by browsing or drag-and-dropping the certificate.
-
Specify the name for the certificate.
-
Select OK.
If the newly uploaded certificate does not appear in the dropdown for Local Certificate, select OK, then select the mapped device and edit once more.
-
Use the Local Certificate dropdown to select the newly uploaded certificate.
-
Select OK to save the per-device mapping.
-
Provide a change note and select OK to save the dynamic local certificate.
Apply the certificate to the FortiGate in FortiManager
To apply the certificate to the FortiGate in FortiManager:
-
Navigate to Device & Groups, and select the FortiGate you wish to install the certificate on.
-
Select System: Settings from the top menu bar.
-
Under Administration Settings, use the dropdown next to HTTPS Server Certificate to select the certificate you uploaded in the previous step.
-
Select Apply.
Install the certificate
To install the certificate on the FortiGate:
-
Select Install Wizard from the top menu bar
-
Select Install Device Settings (only) and click Next.
-
Select the device you wish to install the certificate on, and click Next.
-
If the connection is up, proceed by clicking Install.
-
You may wish to review the Install Preview to ensure all changes are as expected prior to installing.
-
-
Select Finish when the installer completes.
Verify the certificate was installed correctly
To verify the certificate was successfully installed on FortiGate:
-
Navigate to the FortiGate’s GUI web page. This should match the SAN field of the certificate.
-
Notice how the connection is secure, and the certificate used to secure the connection is the same certificate you configured in the previous steps.