Skip to main content
sysram
sysram
New Member
July 7, 2022
Question

Lets Encrypt with Virtual Server

  • July 7, 2022
  • 5 replies
  • 4822 views

Hi

 

We have a Virtual Server only with HTTPS.
Now we upgraded to 7.0.6 and I read that it would be possible to use the newly implemented ACME client.
So I tried to get a LE certificate with the GUI but I always get the error:

Timeout during connect (likely firewall problem)

 

I know LE very well and normally the verification will be passed on the webserver.
So I'm confused how the forti will catch the LE requese on Port 80 and answer it correctly

 

 

 

5 replies

pminarik
Staff
pminarik
Staff
July 8, 2022

I haven't gotten around to test it to personally confirm, but my impression from all discussions I've seen so far has been that the validation port must be either unused, or at most used by the admin GUI (in which case the httpsd process can decide whether a request is a letsencrypt validation attempt, or access to the GUI). In other words, a VIP sending ports 80/443 off to elsewhere will block the validation from succeeding.

sysram
sysramAuthor
New Member
July 8, 2022

Ok I forgot one detail.
We have a lot of public IPs.
The IP and URL which I want to use is only configured as a Virtual Server

It is not binded to an Interface

pminarik
Staff
pminarik
Staff
July 8, 2022

For a plain VIP, this would be a clear "not supported", for server-load-balance VIPs (virtual server), I would not be too sure. With that said, the documentation says "no VIPs" - https://docs.fortinet.com/document/fortigate/7.0.0/new-features/822087/acme-certificate-support

sysram
sysramAuthor
New Member
July 8, 2022

Well if Virtual Servers are not supported, then this ACME integration is not really good.
I was able to use it for SSL VPN. But we have a lot of VIPs and VS. So they should do a better implementation.

    kostixxa
    kostixxa
    Visitor III
    May 16, 2023

    Totally agree, If ACME is suitable only for SSLVPN and Fortigate itself than it is almost useless. 

    pminarik
    Staff
    pminarik
    Staff
    May 25, 2023

    For proper reverse-proxying, there seems to be push towards FortiWeb or FortiADC.

    FortiGate's reverse-proxy (server-load-balancing VIP) is rather simple. And it would seem that ACME is intended to be used mainly for web-GUI or SSL-VPN. 

    Terms & ConditionsAccessibility statement