Automated Certificate Replacement Vendors - FortiADC Load Balancers

Hi @Doug_Smith ,

FortiADC already contains a native ACME client—no external script or third-party “certificate-bot” is required. you point the appliance to any ACME directory URL (Let’s Encrypt, DigiCert CertCentral, Venafi ACME, Buypass, …) and choose a validation method (DNS-01 or TLS-ALPN-01). FortiADC creates the account key, obtains the certificate, binds it to your HTTPS virtual server, and auto-renews before X-day expiry.

Fortinet-published sources confirm that (1) FortiADC’s built-in ACME client supports any standards-based ACME CA, (2) all configuration can be done directly on the FortiADC, and (3) automatic renewal is handled by the appliance itself—eliminating the need for manual certificate rollovers.

1- Step-by-step GUI wizard and description of ACME automation (“Importing a local certificate (ACME)”).

https://docs.fortinet.com/document/fortiadc/7.6.1/administration-guide/167333/importing-a-local-certificate

2- CLI syntax for execute certificate local import automated (supports custom ACME CAs).

https://docs.fortinet.com/document/fortiadc/7.6.2/cli-reference/67686/config-system-certificate-local

3- New-feature note describing the TLS-ALPN-01 enhancements and auto-renewal logic added in 7.6.x.

https://docs.fortinet.com/document/fortiadc/7.6.0/new-features/217485/acme-tls-alpn-01-enhancements

NOTE: Unfortunately, I haven’t had the chance to test these steps in a lab environment yet, although they appear theoretically feasible. I wanted to share this information separately.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

was successful getting it to work with DigiCert - had to use EAB - External Account Binding - which was not available until 7.6.6 code….but got it setup with a tight 3 day life….renewing when there was 2 days remaining to force it to renew every single day.  A key thing I learned is that IF you want it to renew AUTOMATICALLY….you have to use TLS-ALPN-01 challenge type - NOT - DNS-01.  Another gotcha is you CANNOT do wildcard cert auto-renewal whatsoever!!!! You can ONLY do wildcard certs with a DNS-01 Challenge type - which does NOT auto-renew!! :-(  See attached screenshot.  We used to get a wildcard cert for like 20-30 different vips on our FortiADC load balancer once a year.  Fast forward to today and I am going to have to get a unique cert for every single VIP using TLS-ALPN-01 challenge method….so 1 cert manual to 20-30 - auto-renewal.  Once I set them up it SHOULD renew like clock work...but disappointing to find.  Apparently ACME does support it but the FortiADC does NOT.  Hopefully it will in the future.