Technical Tip: Site-to-Site IPsec VPN Configuration with Certificate-Based Authentication.

Step 1: Create or obtain the Root CA Certificate and then import it under Create/Import -> Remote Certificate. 

Step 2: Obtain a child/server/client certificate with .p12 format and import it under Create/Import -> Certificate. 

Choose with Certificate + key or Certificate with .p12 Format. 

Here, the Root CA is tftpFortinet, and the Server/Entity/Client Certificate is FortiGateCert_cert.

The same procedure must be followed on the peer device.

Step 3. Configure IPSec tunnels on both the Firewalls, and then choose the authentication as Signature instead of Pre-Shared Key. 

Technical Tip: How to set up IPsec VPN between two FortiGates (Using VPN Setup wizard and custom profile)

Local Firewall:

1. Choose the Entity Certificate as the imported Server Certificate, which has a .p12 format.

2. For the Peer Certificate, create a new PKI user, enter the required name, and select the imported Root CA. 

All other configurations remain the same; only the authentication method should be changed from Pre-Shared Key to Signature.

The same steps must be followed for the Remote Firewall. 

Sample output:

Use the following CLI commands to verify tunnel status:

IPSec using FortiGate default certificates:

Troubleshooting Tip: IPSec tunnel with certificate-based authentication between two FortiGates

Troubleshooting Tip: IPsec certificate based VPN, failed to load private key /etc/cert/local/