Fortinet black logo

CLI Reference

system certificate letsencrypt

system certificate letsencrypt

Instead of uploading CA certificate from your local directory, an easier way is to configure FortiWeb to obtain a CA certificate from Let's encrypt on behalf of you.

It's recommended to configure Let's Encrypt certificate through Web UI, where more functions are offered. Refer to "Let's Encrypt certificates" in FortiWeb Administration Guide.

To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For details, see Permissions.

Syntax

config system certificate letsencrypt

edit "<certificate_name>"

set domain "<application_domain_name>"

set renewal-period <int>

set validation-method {HTTP-01 | TLS-ALPN-01 | DNS-01}

set key-type {RSA-2048 | RSA-3072 | RSA-4096}

config subject-alternative-names

edit <index>

set san-dns <domain_name>

end

next

end

Variable Description Default

"<certificate_name>"

Enter the name of a certificate file. The maximum length is 63 characters. No default.

domain "<application_domain_name>"

Enter the domain name of your application. FortiWeb will then retrieve the CA certificate for this domain from Let's encrypt.
For Let's encrypt certificate, it's supported to added add up to 11 domains. One of them should be root domain, while the rest 10 should all belong to the root domain.
It's recommended to enter the root domain here, then add the rest domain items in san-dns <domain_name>.

No default.

renewal-period <int>

Set how soon FortiWeb obtains the TLS certificate from Let’s Encrypt. The valid range is 1-60 days.

30 (days)

validation-method {HTTP-01 | TLS-ALPN-01 | DNS-01}

  • HTTP-01: Let's Encrypt will send HTTP request to FortiWeb for validation.
    When in RP mode, you must select HTTP service and uses port 80 for it in the server policy which uses the Let's Encrypt certificate.
    When in TTP mode, the back-end server which uses Letsencrypt certificate should have port 80 enabled.
    Redirect HTTP to HTTPS should not be enabled when the validation is in process.
  • TLS-ALPN-01: This method allows Let's Encrypt to send HTTPS requests to FortiWeb for validation. You must select HTTPS service in the server policy which uses the Let's Encrypt certificate.
  • DNS-01: This method allows Let's Encrypt to do validation through your DNS provider. FortiWeb will generate a TXT record, then you need to add this TXT record to the DNS record. Refer to "Fulfilling the DNS-01 challenge" in FortiWeb Administration Guide.

HTTP-01

key-type {RSA-2048 | RSA-3072 | RSA-4096}

Select Key Type. RSA algorithm with different key length can be implemented and accepted by the Let’s Encrypt Server. Those key sizes are 2048, 3072, and 4096 bits. Please note that larger keys consume more computing resources, however, achieve better security.

RSA-2048

san-dns <domain_name>

Enter domain names. Up to 10 items can be added and they all should belong to the same domain.

No default.

Related topics

system certificate letsencrypt

system certificate letsencrypt

Instead of uploading CA certificate from your local directory, an easier way is to configure FortiWeb to obtain a CA certificate from Let's encrypt on behalf of you.

It's recommended to configure Let's Encrypt certificate through Web UI, where more functions are offered. Refer to "Let's Encrypt certificates" in FortiWeb Administration Guide.

To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For details, see Permissions.

Syntax

config system certificate letsencrypt

edit "<certificate_name>"

set domain "<application_domain_name>"

set renewal-period <int>

set validation-method {HTTP-01 | TLS-ALPN-01 | DNS-01}

set key-type {RSA-2048 | RSA-3072 | RSA-4096}

config subject-alternative-names

edit <index>

set san-dns <domain_name>

end

next

end

Variable Description Default

"<certificate_name>"

Enter the name of a certificate file. The maximum length is 63 characters. No default.

domain "<application_domain_name>"

Enter the domain name of your application. FortiWeb will then retrieve the CA certificate for this domain from Let's encrypt.
For Let's encrypt certificate, it's supported to added add up to 11 domains. One of them should be root domain, while the rest 10 should all belong to the root domain.
It's recommended to enter the root domain here, then add the rest domain items in san-dns <domain_name>.

No default.

renewal-period <int>

Set how soon FortiWeb obtains the TLS certificate from Let’s Encrypt. The valid range is 1-60 days.

30 (days)

validation-method {HTTP-01 | TLS-ALPN-01 | DNS-01}

  • HTTP-01: Let's Encrypt will send HTTP request to FortiWeb for validation.
    When in RP mode, you must select HTTP service and uses port 80 for it in the server policy which uses the Let's Encrypt certificate.
    When in TTP mode, the back-end server which uses Letsencrypt certificate should have port 80 enabled.
    Redirect HTTP to HTTPS should not be enabled when the validation is in process.
  • TLS-ALPN-01: This method allows Let's Encrypt to send HTTPS requests to FortiWeb for validation. You must select HTTPS service in the server policy which uses the Let's Encrypt certificate.
  • DNS-01: This method allows Let's Encrypt to do validation through your DNS provider. FortiWeb will generate a TXT record, then you need to add this TXT record to the DNS record. Refer to "Fulfilling the DNS-01 challenge" in FortiWeb Administration Guide.

HTTP-01

key-type {RSA-2048 | RSA-3072 | RSA-4096}

Select Key Type. RSA algorithm with different key length can be implemented and accepted by the Let’s Encrypt Server. Those key sizes are 2048, 3072, and 4096 bits. Please note that larger keys consume more computing resources, however, achieve better security.

RSA-2048

san-dns <domain_name>

Enter domain names. Up to 10 items can be added and they all should belong to the same domain.

No default.

Related topics