Skip to main content
PampuTV
PampuTV
Explorer
January 29, 2022
Question

FGT export Let's Encrypt certificate

  • January 29, 2022
  • 4 replies
  • 3170 views

Hi community,

 

I am currently using the Let's Encrypt feature on my FGT (FOS 7.0.4).

Everything is working really good.

I just had the idea to use the FGT as a "certificate hub". So the external FQDN of my NAS points to the FGT WAN IP. This way the FGT can issue a certificate for the external FQDN for my NAS.

Now I am looking into a way to export the issued Let's Encrypt certificate (cert file, key file and passphrase). Found out that the cert file and key file are stored at the FGT and can be exported over the CLI. Sadly, the passphrase is "only" saved encrypted on the CLI (because of security reasons).

To import the Let's Encrypt certificate to my NAS, I need the passphrase unencrypted. 

Any ideas how I could get the encrypted passphrase on the CLI into an unencrypted form?

 

Looking forward for your ideas. Many thanks.


Kind regards

Dominik

 

FortiGate

4 replies

AlexC-FTNT
Staff
AlexC-FTNT
Staff
February 28, 2022

Hello Dominik,

It is not possible to obtain the passphrase once a CSR is generated by FortiGate. It was possible in early codes (FortiOS <5.4), but the option is removed due to security reasons.
It is ideal to generate a CSR from a common source like OpenSSL so that the private key file and passphrase are available. Only in this situation, once you get the wildcard signed, you can then use it on more than one device.

Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
February 28, 2022

Hey Pampu,

in addition to what Alex mentioned, FortiGate is not intended to act as certificate hub as you described - the CSRs it generates are intended for itself, and no other device.

FortiAuthenticator could act as you're looking for - it can generate CSRs, have them signed by Let's Encrypt or whatever CA of your choice, and then you export the signed certificate and key (once; the key is removed after first export) and provide them to users/machines as desired.

tonifan72
tonifan72
New Member
October 28, 2025

If you are comfortable with CLI, you can...

kulansha2
kulansha2
New Member
October 28, 2025

it needs to have the acme client listening on port 80 and 443 not sure if we can translate the http requests to https on fortigate. i have it setup i just close the ports after the cert is renewed

Terms & ConditionsAccessibility statement