Technical Tip : Generate and sign certificates using OpenSSL in Windows OS for VPN.

[lestopace]

Description	This article describes how to sign and generate certificates using OpenSSL in Windows OS that can be used for SSL VPN and IPSec VPN configuration.
Scope	FortiGate.
Solution	Create a CA with OpenSSL: # req -new -x509 -days 3650 -keyout caprivatekey.pem -out cacertificate.pem Note: cacertificate.pem is the public key and should be imported into the FortiGate. Generate a Certificate Request on the FortiGate and download it. Sign the FortiGate certificate. # x509 -req -in VPNSSL.csr -CA cacertificate.pem -CAkey caprivatekey.pem -CAcreateserial -out VPNSSL.cer -days 3650 -sha256 Import the signed certificate (VPNSSL.cer) into the FortiGate as a 'local certificate'. This can now be used in IPSec or SSLVPN configuration as a server certificate. Note: The certificates and private keys that were signed and generated should be located in the 'bin' folder of OpenSSL(i.e. C:\Program Files\OpenSSL-Win64\bin). Create user certificate. # req -new -nodes -out usercert.csr -keyout usercert.key # x509 -req -in usercert.csr -CA cacertificate.pem -CAkey caprivatekey.pem -CAcreateserial -out usercert.cer -days 3650 -sha256 # pkcs12 -export -out usercert.pfx -inkey usercert.key -in usercert.cer Upload cacertificate.pem to FortiGate as CA certificate. Bind this CA_Cert_X to the PKI users: Technical Note: Upload Certificate using PEM format Technical Tip: How to import an SSL certificate as a local certificate Import the usercert.pfx certificate into the Personal Section on the Certificates management console.