| Description | This article describes how to generate an admin server certificate via SCEP on FortiGate. |
| Scope | FortiGate, FortiAuthenticator. |
| Solution |
In order to automate certificate enrollment via SCEP for admin server certificate, it is necessary to follow these exact steps in order to have it enrolled successfully:
In this case, FortiAuthenticator is used. In order to make it available to process SCEP requests, SCEP has to be enabled on the interfaces handling SCEP enrollments.
Enable SCEP and set the default CA:
*in case Automatic enrollment method is selected, it is necessary to create an enrollment for each request.
On FortiGate, issue the following command to fetch the CA certificate from an SCEP server.
fgt (global) # execute vpn certificate ca import auto http://10.5.197.12/app/cert/scep/
The certificate appears in the Remote CA section.
fgt (global) # execute vpn certificate local generate rsa localcert 2048 localcert CZ ST L OU "" admin@cert.arpa "" http://10.5.197.12/app/cert/scep/ <enrollment password> Global certificate SCEP Signing Request started. Please check it in a while.
Approve the enrollment on FortiAuthenticator and select desired Key Usages - for example, Digital Signature, Key Encipherment, Server Authentication for the admin web server certificate.
After a while (note that this is not immediate), the certificate will appear on the FortiGate as valid.
The last step is to set the certificate as the admin-server-cert on FortiGate, which can be done by issuing the following commands:
fgt (global) # config system global |
