Technical Tip : How to generate a 3GPP certificate on FortiGate using FortiAuthenticator as the CMPv2 server

[athirat]

Description	This article describes how to use FortiAuthenticator as a CMPv2 server to rollout 3GPP certificates to FortiGates in SecGw for mobile network deployments.
Scope	FortiGate v6.2.x onwards, FortiAuthenticator v6.6.x onwards.
Solution	Find the steps below for setup : On FortiAuthenticator : Go to 'Certificate Management -> CMP -> General' to enable CMPV2. Once enabled, select a server certificate and setup the default enrollment password: Go to 'Network -> Interfaces' to enable CMP services under the interface on which FortiGate will be connecting: Note: Can use HTTPS or HTTP - this example demonstrates TCP/80. Go to 'Certificate Management -> Local CAs' and set up a Local CA certificate which will be used for signing the requests. Go to 'Certificate Management -> CMP -> Enrollment Request' and create a new enrollment certificate with the request type set to '3GPP'. Note: The Device vendor CA certificate would be the CA signing the FortiGate authentication certificate. In this example, the 'Fortinet_Factory' certificate will be used on FortiGate, so the Fortinet CA certificate is selected. The enrolment request can be customized as per requirement by setting an appropriate renewal period and selecting the required key usages. This will be seen in the 'Pending' status when created: On FortiGate: Import the FortiAuthenticator server certificate under 'Remote Certificate': config certificate remote # edit G_REMOTE_Cert_1 (G_REMOTE_Cert_1) # get name : G_REMOTE_Cert_1 remote : Subject: C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = Fortiauthenticator, CN = Default-Server-Certificate-D01CBD01 ..... The IR syntax on FortiGate is as follows: execute vpn certificate local generate cmp <local name> <key size> <server-address:port> <path> <SrvCert> <AuthCert> <username> <password>  In this example: execute vpn certificate local generate cmp SecGW-cert 2048 10.5.145.56:80 /app/cert/cmp2/ G_REMOTE_Cert_1 Fortinet_Factory Certificate CMP IR started, Please check it in a while Successfully issued: config certificate local     edit SecGW-cert         get         name : SecGW-cert         password : *         comments :         private-key :         certificate :         Subject: CN = FG481FTK1111111.unknown.com         Issuer: O = test, OU = SECGW, CN = FAC         .         .         state :         range : global         source : user         source-ip : 0.0.0.0         ike-localid-type : asn1dn         enroll-protocol : cmpv2         cmp-server : 10.5.145.56         cmp-path : /app/cert/cmp2/         cmp-server-cert : G_REMOTE_Cert_1         cmp-regeneration-method: keyupate         auto-regenerate-days: 0         auto-regenerate-days-warning: 0 Troubleshooting: On FortiGate, the process can be tracked using CMP debugs below or by running sniffers to FortiAuthenticator IP: diagnose debug reset diagnose debug application cmp 255 diagnose debug enable In captures on filtering CMP: On FortiAuthenticator, debugs are available on the Debug page -> Others -> SCEP/CMP.