Technical Tip: How to assign an SSL certificate for remote administration of FortiGate

Description

This article describes how to use an SSL certificate on FortiGate for remote administration via web browser.

Scope

FortiGate v7.2.x, v7.4.x, v7.6.x, v8.0.

Solution

Assigning an SSL certificate to the admin interface for remote administration can be configured via the CLI. By default, the self-signed certificate is used:

FGT # config system global 
FGT (global) # show full | grep admin-server-cert
    set admin-server-cert "self-sign" 

To check the certificates available on FortiGate, the following CLI command is used:

FGT # config system global 
FGT (global) # set admin-server-cert
Available    Certificates:
self-sign       local
Fortinet_Factory        local
Fortinet_Factory_Backup local
Fortinet_GUI_Server     local 

A signed SSL certificate can also be used for administrator GUI access, and for other functions that require a certificate.

SSL certificates can be purchased from any Certificate Authority (CA), such as DigiCert, GoDaddy, or GlobalSign, etc. or a self-signed certificate can also be generated using open-source tools such as OpenSSL or Windows.

To use one of the SSL certificates listed, use the following CLI commands:

config system global
    set admin-server-cert <cert_name>
end

Once this has been configured, the FortiGate will use this certificate on the admin interface for remote HTTPS administration.

The FortiGate will then behave in the same way as outlined in the related article when remote HTTPS administration requests are made via an HTTP browser.

Related documents:

• Technical Tip: How to create an OpenSSL certificate to authenticate PKI users on FortiGate with a dial-up tunnel

• Procuring and importing a signed SSL certificate