Overview

This document provides the steps to install SSL certificates in a single FortiNAC appliance using the Administration UI.For other configurations, refer to the applicable document below:

• Install SSL Certificates Using the Admin UI (Single Appliance)

• Install SSL Certificates Using the Admin UI (Appliances managed by Manager)

Certificate Targets

SSL certificates are required in order to secure FortiNAC communications.The following are secured using a similar procedure via the Administration UI:

• Admin UI

• Captive Portal

• FortiNAC agents

• Local RADIUS Server (FortiNAC version 8.8 and above)

  • Local RADIUS Server (EAP)

  • RADIUS Endpoint Trust (EAP-TLS)

See Keystore for SSL/TLS Communications in Appendix for instructions for the following.

• LDAP servers

• FortiClient EMS integrations

• Nozomi systems integrations

Considerations

• User needs to already have determined FortiNAC hostnames, which will be secured by the certificates (certificates required on all FortiNAC appliances)

• Hostname used for the Portal can be different than the actual hostname of the appliance.This is beneficial when using a combination of internal and external certificates. Setting the Portal hostname differently also prevents revealing the actual appliance hostname to users interacting with the Portal.

Certificate Formats Types and Templates

• Acceptable certificate formats: PEM, PKCS#7/P7B

• Required format when installing certificates via CLI*: PEM

• Local domain certificates: Use Web Service template

• Public certificates: Use Apache Mod or similar

  *If conversion is required, see Appendix section SSL File Conversion Tool Chart.

Procedure Overview

Step 1: Determine FortiNAC Certificate Targets to Secure

Step 2: Obtain a Valid SSL Certificate from a Certificate Authority (CA)

Step 3: Upload the Certificates to FortiNAC

Step 4: Activate Portal Certificates

Required when securing the Captive Portal.

Step 5: Configure Certificate Expiration Warning Alarms

Create alarms to notify when FortiNAC's SSL Certificate is approaching its expiration date.

Step 6: Apply Certificates to Secondary Server (High Availability configurations)

• Option 1: Admin UI Method – Requires a failover to the Secondary Server. A maintenance window may be required.

• Option 2: CLI Method – A maintenance window is not required.