system encryption-method

Use this command to use generate a random private encryption key and store it into the TPM (Trusted Platform Module). This key is used to encrypt and decrypt configuration passwords and certificates, ensuring that sensitive data remains protected. In HA deployments, the encryption key is automatically synchronized to the secondary node’s TPM, preventing unauthorized access across different systems.

After enabling private encryption, it is recommended to generate a sample using execute private-encryption-key sample and record the output. If backup configurations fail to restore, the private key may have changed. Use execute private-encryption-key verify with the previously recorded sample to check if it matches the current private key. If verification fails, a new private key was generated, and the backup configuration must be re-encrypted. For details, see private-encryption-key.

Syntax

config system encryption-method

set private-encryption-key {enable|disable}

end

Variable	Description	Default
private-encryption-key {enable|disable}	When enabled, FortiWeb generates a random encryption key and stores it in TPM.	disable

Related topic

private-encryption-key