Step 1: Determine FortiNAC Certificate Targets to Secure

SSL certificates can be installed in one or more Certificate Targets in FortiNAC. Determine use cases so the appropriate certificates can be acquired. Different certificates can be installed for different targets. Not all targets may be used.

Refer to the Deployment Guide (Create and Install SSL Certificates) for details on specific use cases.

SSL Certificates can be issued from the following Certificate Authorities (CA):

• Corporate Owned Internal CA (Internal)

  • Certificates issued from within the organization. You may act as your own Certificate Authority (CA) and use your own internal certificate, as long as all systems in your domain use the same certificate.

  • Certificate types: Individual & SAN (Subject Alternative Name)*

• Third party public (External)

  • Certificates issued from Certificate Authorities like GoDaddy, DigiCert, GlobalSign, etc.

  • Certificate types: Individual, SAN* & Wildcard

* SAN certificates can be used to secure multiple host names and/or IP addresses. For example, in a Layer 2 HA environment the virtual, Primary, and Secondary appliance host names and their corresponding IP addresses can all be secured with one certificate.

Certificate Target	Function	Certificate to Use
Admin UI	Access to the FortiNAC UI (https://<FortiNAC FQDN>:8443/)	Internal or External
Persistent Agent	Persistent Agent communication	Internal (Recommended) or External
Portal	Captive Portal access and Dissolvable Agent communication	External
Local RADIUS Server (EAP)	For use when FortiNAC is acting as the 802.1x EAP termination point.	Internal or External (avoid wildcard certificates)
RADIUS Endpoint Trust	Client-side certificate validation (EAP-TLS)	Internal or External (avoid wildcard certificates)