system certificate letsencrypt

"<certificate_name>"

domain "<application_domain_name>"

Enter the domain name of your application. FortiWeb will then retrieve the CA certificate for this domain from Let's encrypt.
For Let's encrypt certificate, it's supported to added add up to 11 domains. One of them should be root domain, while the rest 10 should all belong to the root domain.
It's recommended to enter the root domain here, then add the rest domain items in san-dns <domain_name>.

renewal-period <int>

Set how soon FortiWeb obtains the TLS certificate from Let’s Encrypt. The valid range is 1-60 days.

validation-method {HTTP-01 | TLS-ALPN-01 | DNS-01}

• HTTP-01: Let's Encrypt will send HTTP request to FortiWeb for validation.
  When in RP mode, you must select HTTP service and uses port 80 for it in the server policy which uses the Let's Encrypt certificate.
  When in TTP mode, the back-end server which uses Letsencrypt certificate should have port 80 enabled.
  Redirect HTTP to HTTPS should not be enabled when the validation is in process.
• TLS-ALPN-01: This method allows Let's Encrypt to send HTTPS requests to FortiWeb for validation. You must select HTTPS service in the server policy which uses the Let's Encrypt certificate.
• DNS-01: This method allows Let's Encrypt to do validation through your DNS provider. FortiWeb will generate a TXT record, then you need to add this TXT record to the DNS record. Refer to "Fulfilling the DNS-01 challenge" in FortiWeb Administration Guide.

key-type {RSA-2048 | RSA-3072 | RSA-4096}

Select Key Type. RSA algorithm with different key length can be implemented and accepted by the Let’s Encrypt Server. Those key sizes are 2048, 3072, and 4096 bits. Please note that larger keys consume more computing resources, however, achieve better security.