Technical Tip: Using an externally signed local (custom) certificate for OFTP connection

[kcheng]

Description	This article describes how to configure a FortiAnalyzer to use an externally signed local (custom) certificate for OFTP connection between FortiGate and FortiAnalyzer, for log transmission purposes.
Scope	FortiAnalyzer, FortiGate.
Solution	Generate a Certificate Signing Request from FortiAnalyzer. Navigate to System Settings -> Certificates -> Local Certificates and select Create New: Enter the relevant information in the CSR request. It is mandatory to enter the FortiAnalyzer Serial Number into the Domain Name parameter if certificate validation is enabled on FortiGate: Download the CSR generated: To generate the certificate, sign the CSR with either the public CA or the private CA. In this demo, FortiAuthenticator is used as the CA server:                                      After signing the CSR, export and download the certificate generated: In FortiAnalyzer, import the signed certificate:                                  The certificate status will change from Pending to OK once the certificate is uploaded correctly: Once the certificate has been imported, configure the use of the local certificate in the CLI and restart the OFTP daemon: config system certificate oftp     set mode local     set local "FAZ_SSL" end diag test app oftpd 99 In FortiGate, import the CA certificate if a private CA was used. In this case, the FortiAuthenticator CA certificate used to sign the CSR is imported: Validate the connection status in the FortiGate: To perform verification in the FortiGate CLI, run the following command: exec log fortianalyzer test-connectivity Related article: Technical Tip : Adding SAN(Subject Alternative Name) while generating CSR(Certificate Signing Reques...