|
In v7.2.1, a new default certificate 'Fortinet_GUI_Server' is introduced for HTTPS administrative access.
If a self-signed certificate is used, the error 'Untrusted HTTPS server certificate' will be shown on the dashboard.
It is best practice to use a signed and trusted HTTPS server certificate, but it is also possible to remove this warning by using the 'Fortinet_GUI_Server' certificate.
To do so, see below:
- Go to System -> Settings -> HTTPS Server Certificate, select 'Fortinet_GUI_Server', and select 'Apply'.
If it is not required for this PC to trust the new Fortinet_GUI_Server certificate, skip to Step 6. To resolve browser-based certificate warnings, continue to the remaining steps.
-
Ensure that the certificate option is enabled under System -> Feature Visibility -> Certificates.
-
Download the certificate from System -> Settings -> HTTPS Server Certificate. In this step, select 'Download HTTPS CA certificate'. 'Fortinet_CA_SSL' will be downloaded:
An alternative path to download the same CA certificate is System -> Certificates -> Fortinet_CA_SSL -> Download.
- Install the certificate in the PC's trusted root CA certificate store:
Since installing certificates can affect which certificates the browser will show as trusted, opening the file will show a warning.
Select Store Location -> 'Local Machine'.
Place the certificate in 'Trusted Root Certification Authorities'.
- Clear the browser cache and log in to the GUI in a new browser window to verify the HTTPS server certificate is now trusted by the PC.
- 'Untrusted HTTPS server certificate' has been replaced with a link to download the current HTTPS CA certificate.
Repeat steps 2 to 5 as needed for any other PC's that are required to trust the FortiGate's CA certificate.
Note: To assign an HTTPS server certificate for older versions, use the following commands:
config system global
set admin-server-cert <new_cert>
end
By default, 'Fortinet_CA_SSL' is used to sign 'Fortinet_GUI_Server' and firewall block pages. It is also the default CA used if deep inspection is configured. Installing the certificate on a PC will also remove certificate warnings for those functions. See the articles 'Certificate error when accessing blocked page' and 'Deep Inspection' for more detail.
Related documents:
|
