Explorer II

Solved

Using Same Certificate for IPSec VPN Authentication

5 replies
4027 views

Hi,

I know this is not best practice to use same certificate on all FortiGate for IPSec VPN Authentication.

But I'm wondering, let say I deployed Hub and Spoke with 10 branches connect to DC as hub.

Can all FortiGate use same certificate for IPSec VPN authentication? Does FortiGate can authenticate each other?

Thanks

Ari

FortiGate

gflemingAnswer

Staff

Oh I'm sorry I mis-read you original question. I thought you were using the certificates for IPSec remote access for clients. This is site-to-site IPSec VPN?

If so yes fairly certain it will work if you use the same certificates everywhere. Just note this provides almost exactly the same security as PSK. If one certificate is compromised you have to reset every node and reconfigure the certificates.

Anthony_E

Staff

Hello Ari,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

Best Regards

gfleming

Staff

You can do it but it will be hard to make it a trusted certificate for all of your clients. It will need SANs or wildcard CN so that each FortiGate that is presenting it will be verified accordingly. Otherwise users will get untrusted certificate warnings.

Why not just have one central FortiGate as your VPN gateway?

arie12092Author

Explorer II

Hi,

So, technically it's possible to use same certificate on the FortiGate branches to connect to the FortiGate DC in IPSec VPN, but it requires to different in SAN or wildcard CN, is it correct?

What will happen when the certificate doesn't have SAN or wildcard CN? Will the IPSec VPN authentication between FortiGate branch and FortiGate DC fail?

Thanks

Arie

gflemingAnswer

Staff

Oh I'm sorry I mis-read you original question. I thought you were using the certificates for IPSec remote access for clients. This is site-to-site IPSec VPN?

If so yes fairly certain it will work if you use the same certificates everywhere. Just note this provides almost exactly the same security as PSK. If one certificate is compromised you have to reset every node and reconfigure the certificates.

Sign up

Login with SSO

Login to the community

Login with SSO