Adding Fortigate VM eval to FortiManager VM eval

Hi, 

No, there is no way.

This only works with version lower than v7.6.2/v7.4.6/v7.2.10,

And, This is the problem, the FortiOS Versions.

from the link:

https://community.fortinet.com/t5/FortiManager/Technical-Tip-Setup-custom-certificate-for-FGFM-proto...

you can see:

    Note: 

     Starting in v7.6.2/v7.4.6/v7.2.10, the fgfm-peercert-withoutsn command is no longer         supported, and FortiManager will always check the FortiGate's certificate for the         FortiGate Serial Number.

You can see that the command that allow register fortigate in fortimanager without certificates is only valid in lower versions: 

"

From v7.2.10/v7.4.6/7.6.2 the above command is not available anymore.

"

 included versions

In summary, you can use this command only until versions 7.2.9, 7.4.5 and 7.6.1

config sys global

     set fgfm-peercert-withoutsn enable

And this command is the key for register Eval VM (kvm) fortigate in Fortimanager Eval VM (kvm).

Finally, i have desisted.

And i am working with FGT 7.4.4 and FMG 7.4.3 for my EVAL LAB.

This is the Versions more nearest to 7.4.5 that i have.

I was working with the FMG 7.6.1, BUT is a full BUG, i dont recommended to you

Good luck with your EVAL LAB,

Ru

Hi all, wish I had found this thread earlier!  

I've hit the same issue with 7.6.5 for both FG and FMG.

I went so far as to try and add a new private CA and generate a 512-bit certs for both ends' FGFM protocols but whilst I could load the certificates / CAs and set it for use in FGFM, they refused to actually use the certificate with TLS ( "no suitable signature algorithm" error).  

I will now try to go back and re-build wth 7.6.1 (?) to see if that will work.

Pretty frustrating and big waste of time as there are really no clear error messages from either FG or FMG sides as to what is going on.

Looks like people still looking for solution. The following worked for me for Fortigate VM v7.4.11 Eval + Fortimanager v7.6.6 Trial

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes -keyout MyRootCA.key -out MyRootCA.crt -subj "/CN=MyFortiLab"
openssl req -x509 -newkey ed25519 -nodes -keyout MyFGT-VM.key -CA MyRootCA.crt -CAkey MyRootCA.key -days 3650 -subj "/CN=<My FGT-VM S/N>" -out MyFGT-VM.crt
openssl req -x509 -newkey ed25519 -nodes -keyout MyFMG-VM.key -CA MyRootCA.crt -CAkey MyRootCA.key -days 3650 -subj "/CN=<My FMG-VM S/N>" -out MyFMG-VM.crt

FortiGate:

config vpn certificate ca
 edit "MyRootCA"
 set ca "-----BEGIN CERTIFICATE-----"
end

config vpn certificate local
 edit "MyFGT-VM"
  set private-key "-----BEGIN PRIVATE KEY-----"
  set certificate "-----BEGIN CERTIFICATE-----"
end

config system central-management
 set local-cert "MyFGT-VM"
 set ca-cert "MyRootCA"
end

Fortimanager:
 

config system certificate ca
 edit MyRootCA
  set ca "-----BEGIN CERTIFICATE-----"
end

config system certificate local
 edit MyFMG-VM
  set private-key "-----BEGIN PRIVATE KEY-----"
  set certificate "-----BEGIN CERTIFICATE-----"
end

config system global
    set fgfm-allow-vm enable
    set fgfm-ca-cert MyRootCA
    set fgfm-cert-exclusive enable
    set fgfm-local-cert "MyFMG-VM"
end

FMG-VM64 # diagnose dvm device list
--- There are currently 1 devices/vdoms managed ---
--- There are currently 1 devices/vdoms count for license ---

TYPE            OID    SN               HA      IP              NAME          ADOM   IPS                FIRMWARE        HW_GenX
fmgfaz-managed  169    FGVMEVUT******** -       10.*.*.*        FortiGate-VM  root   7.0 MR4 (2878)  N/A
                |- STATUS: dev-db: not modified; conf: in sync; cond: OK; dm: autoupdated; conn: up; source: FMG
                |- vdom:[3]root flags:1 adom:root pkg:[never-installed]

Hi everyone, It is possible to make it work by creating custom certificates. Here is a guide on how to do it on versions 7.6.7(both FGT and FMG):

 

The Fix: Custom CA + Serial-Number Certificates

Step 1 — Get both serial numbers (FGT & FMG)

On each device:

get system status

Note the Serial-Number field.

Step 2 — Generate a CA and per-device certificates (OpenSSL)

Use ed25519* for the leaf certs — the FortiGate eval license restricts its own CSR generation to RSA-512, which many modern TLS stacks reject with a "no suitable signature algorithm" error. Generating the certs externally with ed25519 avoids that entirely.

*Ed25519 is a modern digital signature algorithm built on elliptic curve cryptography — specifically using a curve called Curve25519 combined with the EdDSA (Edwards-curve Digital Signature Algorithm) signature scheme.

bash

# Root CA
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes \
  -keyout MyRootCA.key -out MyRootCA.crt -subj "/CN=MyFortiLab"

# FortiGate certificate — CN MUST be the FortiGate's serial number
openssl req -x509 -newkey ed25519 -nodes \
  -keyout MyFGT-VM.key -CA MyRootCA.crt -CAkey MyRootCA.key -days 3650 \
  -subj "/CN=<FortiGate Serial Number>" -out MyFGT-VM.crt

# FortiManager certificate — CN = FortiManager's serial number
openssl req -x509 -newkey ed25519 -nodes \
  -keyout MyFMG-VM.key -CA MyRootCA.crt -CAkey MyRootCA.key -days 3650 \
  -subj "/CN=<FortiManager Serial Number>" -out MyFMG-VM.crt

Step 3 — Import certificates via GUI (both devices)

On the FortiGate (System > Certificates):

• Import MyRootCA.crt as a CA Certificate
• Import MyFGT-VM.crt + MyFGT-VM.key as a Local Certificate

Fortigate might rename the certificate for something like CA_Cert_1.

On FortiManager (System Settings > Certificates):

• Import MyRootCA.crt as a CA Certificate
• Import MyFMG-VM.crt + MyFMG-VM.key as a Local Certificate

Note the exact names FortiOS/FortiManager assign on import — they may not match your filenames exactly, and the CLI commands below need exact, case-sensitive matches. 

Step 4 — CLI: bind the certificates for FGFM

On the FortiGate:

config system central-management
    set local-cert "MyFGT-VM"
    set ca-cert "MyRootCA"
end

Known quirk on some builds: ca-cert may not appear as a valid option until after local-cert has been successfully set — if you get a "command parse error" on ca-cert alone, set local-cert first, then try ca-cert again.

On FortiManager:

config system global
    set fgfm-allow-vm enable
    set fgfm-ca-cert MyRootCA
    set fgfm-cert-exclusive enable
    set fgfm-local-cert "MyFMG-VM"
end

Step 5 — If the connection still fails after configuring both sides

Run debug on FortiManager to see exactly where the TLS handshake breaks:

diagnose debug application fgfmsd -1
diagnose debug console timestamp enable
diagnose debug enable

(Disable afterward with diagnose debug disable.)

 

TLSv1.3 read fatal alert: unknown CA" (FortiManager side) — the FortiGate doesn't yet trust MyRootCA. Confirm ca-cert is actually set under central-management on the FortiGate.

"Cert verification error: unable to get local issuer certificate" / Remote issuer shows fortinet-subca2001 — the FortiGate is still presenting its old default eval certificate, not your custom one. The local-cert setting may not have taken effect at the protocol level even though the CLI accepted it — re-issue the set local-cert command to force it to apply, then retry.

Step 6 — Authorize and verify

Once the debug shows both sides presenting the correct certificates, the device will appear on FortiManager under Device Manager > Unauthorized Devices. Authorize it there.

If the FortiGate GUI shows "FortiManager certificate is not verified" at this stage, that's a separate, expected security step (introduced ~FortiOS 7.2.8): the FortiGate must explicitly confirm the FortiManager's serial number before trusting it.

• Via GUI: Security Fabric > Fabric Connectors > Central Management — accept the serial number prompt.
• Via CLI:

config system central-management
    set type fortimanager
    set serial-number <FortiManager Serial Number>
    set fmg <FortiManager IP>
end

Step 7 — Confirm success

diagnose fdsm central-mgmt-status

Look for:

Connection status: Up
Registration status: Registered

And on FortiManager:

diagnose dvm device list

Look for conn: up and conf: in sync against your FortiGate's serial number.

Quick Reference: Root Causes Encountered