Technical Tip: Certificate warning while accessing FortiGate

[bvagadia]

Description	This article describes steps to follow to avoid certificate errors when accessing Fortigate.
Scope	FortiGate.
Solution	The Certificate Warning can be avoided using the below-mentioned procedure only for the HTTP to HTTPS Redirection Authentication Traffic. For this,  use the same *.example.com wildcard certificate which is in the Local Certificate Store. This example follows all the steps required to create and install a local certificate on the FortiGate unit, without using CA software. To generate a certificate request on the FortiGate unit - web-based manager: Go to System -> Certificates -> Local Certificates.  Select Generate. In the Certificate Name field, enter 'FGT'. Note: Do not include spaces in the certificate name. This will ensure the compatibility of a signed certificate as a PKCS12 file to be exported later on if required. Since the IP address is private, we will use the FQDN instead. Select Domain Name, and enter fgt.example.com. Enter values in the Optional Information area to further identify the FortiGate. Organization Unit - Support Organization - Example.com Locality (City) - Bangalore State/Province - Karnataka Country - INDIA E-mail - fgt@example.com From the Key Size list, select 2048 Bit or the most secure option available. In the Enrollment Method, select File-Based to generate the certificate request. Select OK. The request is generated and displayed in the Local Certificates list with a status of PENDING.  Select the Download button to download the request to the management computer. In the File Download dialog box, select Save and save the Certificate Signing Request on the local file system of the management computer. Name the file and save it on the local file system of the management computer. Note: In case using IP address instead of FQDN, make sure to include that in "Subject Alternative Name" field.   Import the SSL certificate into FortiOS and assign it to admin access: Go to System -> Certificates -> Local Certificates. Select Import -> Local Certificate and choose the certificate file. Select OK.  To assign the certificate for admin access, navigate System -> Setting -> Administration Settings -> HTTPS server certificate. On PC Browser Add the CA certificate to the browser.  When accessing FortiGate using HTTPS with a domain name (https://fgt.example.com), the users will get the login prompt without a certificate error. Avoid the Certificate Warning using the below-mentioned procedure only for the HTTP to HTTPS Redirection Authentication Traffic. For this, use the same *.example.com wildcard certificate which is in the Local Certificate Store.  When identity-based authentication is enabled, when users accesses HTTPS sites, Fortigate will redirect to https://fgt.example.com:1003 without Certificate Warning. Related article: Technical Tip: Certificate Error in Admin Access - Fortinet Community