Technical Tip: Correct Subject Alternative Name (SAN) formatting when generating CSR on FortiGate, FortiManager, and FortiAnalyzer

When generating a CSR on FortiGate and a SAN is required, use the following format depending on the SAN type:

For DNS entries:
DNS:example.com.

For IP addresses:
Both of the following formats are accepted:
IP:x.x.x.x.
IP Address:x.x.x.x.

Example SAN format on a FortiGate when generating a new Certificate Signing Request (CSR):

Once the CSR has been generated, to confirm that the SAN has been correctly added before it is signed by the CA, use the built-in Windows 'certutil' as shown in the following example:

After the certificate is signed by a Certificate Authority (CA), the SAN field will reflect the specified values, as shown in the image below.

Note: FortiGate is flexible in SAN formatting and supports both 'IP:' and 'IP Address:' formats.

However, for FortiManager and FortiAnalyzer, only the IP:x.x.x.x format is supported for IP addresses. If IP Address:x.x.x.x is used, the CSR will be generated successfully, but the signed certificate will not include the SAN field at all, as shown in the certificate below.

To ensure proper inclusion of SAN values on FortiManager and FortiAnalyzer, always use:

DNS:example.com for DNS names.

IP:x.x.x.x for IP addresses.

Both an IP address and a DNS name can also be used in the Subject Alternative Name, 'IP:192.168.0.1, DNS:server.example.com'.