Skip to main content
rsingla
Staff
rsingla
Staff
December 9, 2019

Technical Tip: Copying SSL certificates from one FortiWeb to another

  • December 9, 2019
  • 0 replies
  • 4485 views

Description


This article explains how to copy or import/export SSL certificates from one FortiWeb device to another one.

Scope

 

FortiWeb can copy SSL certificates from a Primary to Secondary when both units are part of HA cluster.


Solution

 

Once a SSL certificate is uploaded to the FortiWeb, export the SSL Certificate private key from the GUI of the FortiWeb.
To import/copy the same SSL certificate and private key to another FortiWeb in the environment, two options are available:
 
  • Obtain the certificate & the private key from the original issuer (this option could be time consuming and sometimes not possible).
  • Use the FortiWeb CLI to copy the SSL certificate and the private key.
 
Note:
FortiWeb encodes the keys using a specific mechanism to copy from one FortiWeb to another one from the CLI.
It can be only used on a FortiWeb product and can not be used on any other product for security reasons.
 
To copy SSL certificate and the private key from one FortiWeb to another, follow this process :
 
Log in to FortiWeb (device which already has the SSL certificate and key) and use the following command:
 
conf sys certificate local
     edit lab.fortiweb.com       <----- lab.fortiweb.com is the certificate name.
          show
 
output is shown as below:
 
config system certificate local
    edit "lab.fortiweb.com"
          set certificate "-----BEGIN CERTIFICATE-----
MIIDXDCCAkSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAbMRkwFwYDVQQDExBsYWIu
Zm9ydGl3ZWIuY29tMB4XDTE5MTEwNDA4MTAzOVoXDTI5MTEwNDA4MTAzOVowGzEZ
MBcGA1UEAxMQbGFiLmZvcnRpd2ViLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAJP92MxB9Tdguyfuxys6sTEcZOn/LxJHRt882EPCXQdqnrlL1eF3
L1Dv+d3NJTs6oyJwb/IdoOsre9+HEConoCm4Z8Pr8tO55D0EhmxFTsGyTLAdsXFG
MBsGA1UdEQQUMBKCEGxhYi5mb3J0aXdlYi5jb20wHQYDVR0OBBYEFIFRG1e7cN7F
Pl5h4e4wqhHRJfyuMA0GCSqGSIb3DQEBCwUAA4IBAQAmvCkIoeSZeqFRZeAcV9LO
nGidc3rW+W112Vs5KsR5QNijeYGZCan6TkFuykd3rPydaMh5GckcC5y7yQ7ZezNG
8VWzAhnvP+PEFDjC+uoWi/WEtQBTHOJK3ZVQU+cv+L3rnSQqZhzqEX5mNg7NCi+3
GZmKOSqOlvyft27bKQhpg0PG5XKNUQ5KtTY9JjmBHZJk5scGzKAzCYuhfQRLod+U
+n9kWRkGbDHp0tBO5uRNCy7VyrVEcYi1dNiTdzi9/eF565yUadageXnl6u9NffRE
LRJ5nAK7XR6kz8AfPYkKrtsHYMRDMj/eKSut2fEKoBbazx4aQa8Ev9CINCavFaH1
-----END CERTIFICATE-----"
    set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
AZBMrUJGOUTVXklvvbbO0a7GOHXNWETHPBveckToOxXIWsJGOHVB/hkREwN3UPts
8lknSsJlYZBl/z0GI7jbTOmRne0Deq85J6Fdhz1E8/vzdTZ7FjUegH/mYtLnO0at
afWuK8OgnObH3/ZKnmM0CNNjKC8FtpmnAjBbSmAMu68q0hWg5az/pDLbvh4HLZ+X
5KubPYv68bTZGiXYLdTLNr+y6GaIalIiT+dqMtsF3VVdUTZY7JPZzdbf6rsLn0Ef
UeKovgD7yPKWlUGMhqHP7VGsw0aBWy07fLcPCUWyXaDVH3PWE9l4U5rnxpDywxMb
nb5KanbRKLdK2bkUqxotOr5mgFAR3REYvKUvgurw1pDxwKMW51G5BK2pCAMRQx6y
f9Zvfxe6BlASTIAGhlSRIj2kUh6Jb7feP62uA8xPm45+YhPdpZ+WASnCnrEzqE6U
v4DvfkUgmSviEQU8gGWBF6dDcmAyWJ1bU6NlU8r9ZdWqMIeGydaGfZv1IMWRuqbV
bRV3L1e7jB3aG/rK/2JmoLuqHNiiySodUAx13/yxPf8LGrPxqREezNqaVuiOou/5
r6IdBBqQLpsXXpkZ15ZeJI5ecG2KNyOQ9m1ENVfMTL8tolBVQY8G1sFKtZWJy/Xy
RWeJLPnGmpSXkRIi1HBoBs54lhCYN/pfbllLWmUPZOqGzfeq/riFE4xDiu9OTQBA
UWtBSLEApgmXR34P1dZ8t7vjpepWaCf56mcjGUn71yBqRQsXC7S4t944PeUOt9RL
Re1e0jQ9hXClM4Q3XNCynBoRiBrfQt4DwDvg4/1LunVMD1TrYfqY5TztvsOClQ27
BKWMUm48yjC2ErFV6bt16FvkYNmjar+MbYLS6OMyOguvFDmyTLmbulRxSNgIZzGb
tpRUCqOQZqeU32UE6/kF8N3waPdYhrWJ0tfLJu2sjHrE7+3urEWg6pO3eFwlNyNb
gSd5Fv4C0SWiL7kpb2vy1IM1cSpqAPuLDw+F1jPzBtURGBoEVf4HcPFMnD2hFhaP
zIgdF+wUkNPE1xVIMFHCyYXUPHjj6CineMQ/crKiL2WDvxOf+8fduOt6HJn4yKrK
EAhcK++OdFnTxnN80L/82Mi0th4pRQIiPwP9xw2vql1gY9HlxUDauqIG9ygKUMHu
OB3Z/03tdmdK3r0L6xiBY+V=
-----END ENCRYPTED PRIVATE KEY-----
"
  next
end
 
Copy the above output to a notepad file.
 
Log in to the second FortiWeb and use the following command:
 
config system certificate local
     edit lab.fortiweb.com          <----- Choose any name as per the requirements, this name can be customized and is not hard coded with certificate).
 
Paste the output copied in previous step for certificate including the " " and press enter as shown below:
 
set certificate "-----BEGIN CERTIFICATE-----
MIIDXDCCAkSgAwIBAgIBATANBgkqhkiG9w0BAQsFADAbMRkwFwYDVQQDExBsYWIu
Zm9ydGl3ZWIuY29tMB4XDTE5MTEwNDA4MTAzOVoXDTI5MTEwNDA4MTAzOVowGzEZ
MBcGA1UEAxMQbGFiLmZvcnRpd2ViLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAJP92MxB9Tdguyfuxys6sTEcZOn/LxJHRt882EPCXQdqnrlL1eF3
L1Dv+d3NJTs6oyJwb/IdoOsre9+HEConoCm4Z8Pr8tO55D0EhmxFTsGyTLAdsXFG
MBsGA1UdEQQUMBKCEGxhYi5mb3J0aXdlYi5jb20wHQYDVR0OBBYEFIFRG1e7cN7F
Pl5h4e4wqhHRJfyuMA0GCSqGSIb3DQEBCwUAA4IBAQAmvCkIoeSZeqFRZeAcV9LO
nGidc3rW+W112Vs5KsR5QNijeYGZCan6TkFuykd3rPydaMh5GckcC5y7yQ7ZezNG
8VWzAhnvP+PEFDjC+uoWi/WEtQBTHOJK3ZVQU+cv+L3rnSQqZhzqEX5mNg7NCi+3
GZmKOSqOlvyft27bKQhpg0PG5XKNUQ5KtTY9JjmBHZJk5scGzKAzCYuhfQRLod+U
+n9kWRkGbDHp0tBO5uRNCy7VyrVEcYi1dNiTdzi9/eF565yUadageXnl6u9NffRE
LRJ5nAK7XR6kz8AfPYkKrtsHYMRDMj/eKSut2fEKoBbazx4aQa8Ev9CINCavFaH1
-----END CERTIFICATE-----"
 
If there is no error, paste the output copied in the previous step for the private key, including the " ", press enter and enter command end as shown below:
 
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
AZBMrUJGOUTVXklvvbbO0a7GOHXNWETHPBveckToOxXIWsJGOHVB/hkREwN3UPts
8lknSsJlYZBl/z0GI7jbTOmRne0Deq85J6Fdhz1E8/vzdTZ7FjUegH/mYtLnO0at
afWuK8OgnObH3/ZKnmM0CNNjKC8FtpmnAjBbSmAMu68q0hWg5az/pDLbvh4HLZ+X
5KubPYv68bTZGiXYLdTLNr+y6GaIalIiT+dqMtsF3VVdUTZY7JPZzdbf6rsLn0Ef
UeKovgD7yPKWlUGMhqHP7VGsw0aBWy07fLcPCUWyXaDVH3PWE9l4U5rnxpDywxMb
nb5KanbRKLdK2bkUqxotOr5mgFAR3REYvKUvgurw1pDxwKMW51G5BK2pCAMRQx6y
f9Zvfxe6BlASTIAGhlSRIj2kUh6Jb7feP62uA8xPm45+YhPdpZ+WASnCnrEzqE6U
v4DvfkUgmSviEQU8gGWBF6dDcmAyWJ1bU6NlU8r9ZdWqMIeGydaGfZv1IMWRuqbV
bRV3L1e7jB3aG/rK/2JmoLuqHNiiySodUAx13/yxPf8LGrPxqREezNqaVuiOou/5
r6IdBBqQLpsXXpkZ15ZeJI5ecG2KNyOQ9m1ENVfMTL8tolBVQY8G1sFKtZWJy/Xy
RWeJLPnGmpSXkRIi1HBoBs54lhCYN/pfbllLWmUPZOqGzfeq/riFE4xDiu9OTQBA
UWtBSLEApgmXR34P1dZ8t7vjpepWaCf56mcjGUn71yBqRQsXC7S4t944PeUOt9RL
Re1e0jQ9hXClM4Q3XNCynBoRiBrfQt4DwDvg4/1LunVMD1TrYfqY5TztvsOClQ27
BKWMUm48yjC2ErFV6bt16FvkYNmjar+MbYLS6OMyOguvFDmyTLmbulRxSNgIZzGb
tpRUCqOQZqeU32UE6/kF8N3waPdYhrWJ0tfLJu2sjHrE7+3urEWg6pO3eFwlNyNb
gSd5Fv4C0SWiL7kpb2vy1IM1cSpqAPuLDw+F1jPzBtURGBoEVf4HcPFMnD2hFhaP
zIgdF+wUkNPE1xVIMFHCyYXUPHjj6CineMQ/crKiL2WDvxOf+8fduOt6HJn4yKrK
EAhcK++OdFnTxnN80L/82Mi0th4pRQIiPwP9xw2vql1gY9HlxUDauqIG9ygKUMHu
OB3Z/03tdmdK3r0L6xiBY+V=
-----END ENCRYPTED PRIVATE KEY-----
"
end
 
This will successfully copy the certificate from one FortiWeb to another. Same can be verified from the GUI by going to: System -> Certificates -> Local   or in CLI by running following command:
 
config system certificate local
     show
 
Note:
The same can be done for certificates generated by FortiWeb , but it is needed to add the decoded structure before private key and certificate as shown in the example below (also from v7.4.x, the double quote should be at the end of the line):
 

config system certificate local
    edit CSR_genrated_localy
        set certificate "Certificate:
Data:
Version: 3 (0x2)
Serial Number:
de:6d:04:ea:e1:37:21:70:dd:00:53:6f:67:49:d6:22
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=CA_LAB
Validity
Not Before: Apr 16 12:12:22 2024 GMT
Not After : Apr 1 12:12:22 2027 GMT
Subject: ST=Bohemia, L=Prague, O=LAB, OU=My_LAB, CN=faical.lab1
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:c6:e5:27:5d:e2:91:04:f1:e6:18:8d:9e:dc:f2:
0c:7a:c4:fe:4b:d7:41:7b:0f:5e:0d:7f:3d:d3:37:
f7:74:c8:fe:f7:89:fb:7b:9b:1c:45:61:f4:8c:7a:
31:24:fc:09:76:9c:cd:3d:09:a0:a5:eb:2c:ab:4e:
1d:5e:7d:be:dd:b2:94:8b:78:9e:8b:94:af:9e:4f:
2c:1f:f7:87:cc:7c:be:47:a4:1e:15:66:35:73:bc:
7e:b0:48:66:a9:06:c6:32:ac:9b:ff:7a:9b:8c:fe:
51:e7:42:71:10:c3:0b:84:05:07:72:fd:40:7f:4a:
86:f8:ec:7f:a7:ff:98:93:f2:2e:ec:60:c2:88:d6:
a9:a4:32:1f:9f:4d:04:96:9d:60:7a:e0:83:9b:9b:
bc:e0:cf:01:ba:e3:b9:9f:9f:4c:db:e0:d8:29:e7:
d5:bc:23:a6:d8:db:bf:b0:d5:c0:56:05:14:f4:f2:
d4:05:c6:8a:c0:9e:64:79:b0:3e:42:9e:ac:ca:27:
74:02:83:a2:9e:ad:46:35:18:81:f7:48:b8:cd:09:
ee:13:a1:5a:7a:4d:12:7f:d9:05:48:24:08:1c:d2:
44:c7:cf:00:f4:bd:e4:ef:09:e5:f3:1e:42:ae:0e:
45:45:c9:55:0c:59:ef:e0:2f:8d:c6:29:24:09:34:
7c:a7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
1B:51:02:70:63:6D:74:BF:99:E5:3D:63:1F:0A:A0:81:ED:87:4D:4D
X509v3 Authority Key Identifier:
keyid:BC:5C:67:BB:F4:EF:55:18:A4:10:11:B0:4F:94:AB:AE:A7:57:2D:89
DirName:/CN=CA_LAB
serial:0F:0E:61:F3:81:0E:72:75:5E:35:C5:E2:08:80:A5:26:46:09:16:4C

X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Key Usage:
Digital Signature, Key Encipherment
X509v3 Subject Alternative Name:
DNS:faical.lab1
Signature Algorithm: sha256WithRSAEncryption
bf:86:7d:24:68:26:e3:fa:6f:1b:4f:33:cc:eb:2e:8c:2e:f4:
52:ef:ed:e0:eb:9c:db:88:59:97:c7:9a:64:c7:1d:87:1f:8c:
a3:05:63:9b:29:e9:14:21:4a:86:68:8d:93:03:bc:b9:8b:32:
18:f3:3e:67:9a:6e:47:7d:84:62:63:45:72:9f:9a:66:5d:cb:
05:de:fb:19:63:64:d2:73:63:89:5b:c5:f1:e5:4d:5f:76:c1:
c9:18:4d:c7:d0:d7:4d:08:cb:73:5b:f6:2b:97:56:4c:d4:14:
6b:1f:5b:45:77:f7:3a:76:2a:c8:2c:b9:d6:79:5c:45:52:f9:
87:75:4e:bc:7e:75:66:fb:3d:fd:36:a8:db:84:e4:3d:08:08:
16:a0:c8:80:2c:13:c6:5b:83:5f:5b:c1:43:d4:73:ea:03:75:
9c:14:0e:35:21:ae:53:68:e1:1a:54:e3:ff:af:49:e1:70:91:
20:6b:d1:eb:71:df:8c:62:23:44:ff:61:b8:43:18:60:b4:a2:
b6:7c:62:80:ee:e9:5d:18:a9:fb:8b:ef:84:cf:7c:b1:69:06:
55:6d:9e:4f:4f:33:3a:60:bc:df:c0:27:81:46:b7:de:b1:10:
11:86:17:3d:c1:db:ba:27:bd:a8:fa:81:1d:87:58:ba:f9:e5:
26:ae:fe:1e
-----BEGIN CERTIFICATE-----
<<payload>>
-----END CERTIFICATE-----"
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
<<payload>>
-----END ENCRYPTED PRIVATE KEY-----"
next
end

 

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!