Home / server / Questions / 311695
Accepted
Myles Gray
Asked: 2011-09-16 02:02:21 +0800 CST

Assign CA certificate to Fortigate https WAN interface

  • 772

I have a Fortigate 80C that allows remote administration via https.

I access the URL and all fine but the one thing that really bugs me is that is brings up "untrusted connection" in chrome with the whole "click to proceed" thing.

At the moment the cert is self-signed by the Fortigate unit.

On the unit there are 5 CA signed certs for use but I cannot figure out how to assign these certs to the routers interfaces.

Does anyone know how to assign the CA signed certs to the WAN interface on port 443 so it wont ask me to confirm the cert all the time?

(I know the traffic is still encrypted but it is still nice to have)

ssl certificate https ssl-certificate fortinet

4 Answers

  1. Best Answer

    Upload your certificates to the firewall, Fortigate certificate user guide will help you out on this. Now to use this certificate for HTTPS admin access. Use the following CLI commands:

    config system global
  set admin-server-cert <certname>
end
    • 9

  2. Okay this is what I did on 5.2 so that I could use a certificate signed by our internal CA:

    1. System->Certificates->Local Certificates->Generate (this will generate the CR)
    2. Check-click the newly created CR and Download it and process it on your favorite CA
    3. System->Certificates->Local Certificates->Import (this will import the signed cert), set Type to 'Local Certificate if it isn't already. The FortiGate should now have the CA info filled in for what was the CR.
    4. Follow instructions above for setting the certificate as the admin interface cert:

    Note this article that helps a little bit. However it's a little incomplete:

    1. First do a 'conf system global'
    2. Then do a 'set admin-server-cert ?' to pull up a list
    3. Then 'set admin-server-cert < certname >' and then end
    • 2

  3. The answer is here:

    http://yurisk.info/2013/05/04/disabling-ssl-deep-inspection-proxy-in-fortigate-should-be-easier/

    The relevant commands is here:

    FGT80C # diagnose test application ssl 5
SSL AV Bypass is now on
    • 0
    • -2