Description
This article describes that there may be scenarios where a Certificate and its Private Key is needed on multiple FortiGate/FortiWifi Appliances and/or virtual machines.
The steps to follow will typically work between different firmware, but it is recommended that both units be on the same firmware release version.
No special tools are required beyond CLI access to the appliance.
Scope
This article is no longer applicable in modern firmware versions. The process below is not available since version 6.0. (private key passwords are not recoverable).
Solution
Moving Certificates from one FortiGate/FortiWiFi to another is a simple task of copying the Certificate configuration from one unit to the other.
On the original unit, perform the following:
edit "Fortinet_CA_SSLProxy"
set password ENC xbhxFaK5XBgM8swWpprSCYI6SLBe3/AMOn
/Mj7xazDqFENQXjjXPmD4VXYuYN6zks3O36ECCkxX2kmQkEoyBPke9fV0rT08or7vthB9tlN8
> 3WA5SWJ5J9GsKBLg9WdWpDDwVsio7CaVYx24hX2/98jFNkCgQ90PDz8M6CX9ZboQHLemJgX0h88P5EsVrPhtVqT/PEw==
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
> MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCgU1YXilYKBW2gag
> [omitted for brevity]
> g5vtXWbV3vM8mWMAou4qAR6X/k+5usIqYzqB67wFEMXsYkQ8vb0
> -----END ENCRYPTED PRIVATE KEY-----"
set certificate "-----BEGIN CERTIFICATE-----
> MIID2jCCAsKgAwIBAgIEVC8u3jANBgkqhkiG9w0BAQUFADCBpTELMAkGA1UEBhMC
> [omitted for brevity]
> WY1CW4nQSamY6of2lmQbjfUKNtuyS56Y3MhhfokI0IPPtEsrVpLu89VHyiCQMKpzRu
> -----END CERTIFICATE-----"
unset state
set scep-url ''
set source-ip 0.0.0.0
unset ike-localid-type
next
end
From this output, copy the lines and values for:
set password ENC "[hash text]"
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----" [hash text] "-----END ENCRYPTED PRIVATE KEY-----"
set certificate "-----BEGIN CERTIFICATE-----" [hash text] "-----END CERTIFICATE"
On the other FortiGate/FortiWifi perform the following commands (These need to be entered in the order of:
Password, Private-key, Certificate):
# config vpn certificate local
edit [new_certificate]
set password ENC "[hash text]"
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----" [hash text] "-----END ENCRYPTED PRIVATE KEY-----"
set certificate "-----BEGIN CERTIFICATE-----" [hash text] "-----END CERTIFICATE"
end
If no errors are received after entering all commands, including 'end', the certificate should now appear in the GUI menu and be available for uses that require a private key.
