FortiGate FIPS-CC with Azure SAML
Working on a unit running 7.4.4 with FIPS-CC enabled. Trying to get this integrated with Azure using SAML. I had seen this document:
so followed it as best I was able. Created a csr/key via OpenSSL, got a certificate from a local Windows server (used Webserver template) that is the CA for the domain. Created a PKCS12, imported that into Azure. Downloaded the certificate per the document. When I tried imported it into the FGT initially the firewall complained that it didn't trust the issuing CA. So I imported the root certificate from the CA. When I go back in to import the certificate now as a remote certificate, the GUI says it's importing, but it doesn't show up and isn't available in the cli or when trying to create a new SSO connection.
I noticed that the certificate that was created doesn't have the basic constraints when reviewing the details. Do I need to create the CSR on the FGT and get that signed instead? If so, how do I get the PKCS12 for import into Azure w/o the private key that will be stored on the FGT? I saw a post about getting in the cli via set/unset password and then an export but not sure if that works.