Technical Tip: Sign FortiAuthenticator/FortiGate CSR on Windows PKI via command line

[ggolubovic]

Description	This article describes how to issue certificate(sign CSR) from Windows PKI via command line
Scope	FortiAuthenticator CSR or FortiGate CSR
Solution	The CSR created on FortiAuthenticator or FortiGate, with the Third-party CA certificate signing option, can be signed by Windows PKI from the command line. This approach will always work and resolve the issue with Windows PKI GUI. Windows CLI needs to be executed with admin privileges: Export the CSR to certutil.csr file. Copy the CSR to the Windows PKI server. For example, in C:\tmp\certutil\certutil.csr. List all available certificate templates available on the PKI server from Windows CLI: C:\Users\Administrator>certutil -CATemplates Signing certutil.csr  request with WebSrv CATemplate: C:\tmp\certutil>certreq -submit -attrib "CertificateTemplate:WebSrv" certutil.csr Select the Certificate. Select 'OK'. Save the Certificate and select Save. Import signed.cer to FortiAuthenticator or FortiGate to merge it with CSR.