Description
This article describes the steps how to create a new script that will insert the CA and Local certificate and change the FortiGate GUI settings to use the newly provided certificate.
Scope
FortiManager.
Solution
Create a new CA cert under the DM -> Device & Groups -> Managed FortiGate ->'FGT_name' -> CLI configurations (check it under Feature Visibility) -> VPN -> certificate -> CA -> Create New.
Important fields are:
-
Name.
-
CA.
-
Range.
Then under VPN -> certificate -> local -> Create New.
Fill in the following fields (not all of them are present in the screenshot):
-
name: Example_local_cert.
-
certificate:
-
password:
-
private-key:
-
range: Global
Make a change under System -> Global.
admin-server-cert: Example_local_cert.
Then from the Install Wizard, install Device Settings (only), install preview, and select Download.
The following output can be used to create the new script.
config vpn certificate local
edit "FAR_LOCAL"
set password ENC Z8Zpc/bwU2j1HxCFsp0zLVsmSUfQ2
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIJrTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIPD6OIfSZpVoCAggA
Fnh4+qdMZkLi3MYWSmWVFsd5ZtMcXQ2JFeNw3Q09lIxT
-----END ENCRYPTED PRIVATE KEY-----"
set certificate "-----BEGIN CERTIFICATE-----
MIIFJjCCAw6gAwIBAgIJANlyW9g4KGDSMA0GCSqGSIb3DQEBCwUAMBgxFjAUBgNV
2n2Dw3Wf+KJdHWy9G2PcW7oG37bMDl8phOA=
-----END CERTIFICATE-----"
set range global
next
end
config system global
set admin-server-cert "FAR_LOCAL"
end
config vpn certificate ca
edit "FAR_CA"
set ca "-----BEGIN CERTIFICATE-----
MIIFZTCCA02gAwIBAgIIddfjdvgdelswDQYJKoZIhvcNAQELBQAwGDEWMBQGA1UE
AwwNKi5leGFtcGxlLmNvbTAeFw0yNDAxMzExMDQwNDhaFw0zNDAxMjgxMDQwNDha
usVnBskmcosCdizcnWNC8vzg7KU4+189WNukfw7HVSFlvrarHTOchxQ=
-----END CERTIFICATE-----"
set range global
next
end
To create the script, go under DM -> Scripts -> Create New.
To run the script, go under DM -> Scripts -> 'Script_name' -> Run Script -> Select device/s.
After the successful execution of the script on one device in the device DB for a test can proceed with Install.
When there is a .p12 file with the certificate that will be used can use the following command to extract the local certificate, the CA certificate, and the PEM (this is the order in which they are present currently).
openssl pkcs12 -info -in FAR.p12
It will request the password to decrypt it and all of the information will be present in the CLI from where it can be copied to the required fields.
Troubleshooting:
- Run the below commands in FortiManager CLI before the installation from FortiManager to FortiGate to troubleshoot any issues that might appear during the installation:
diagnose debug application securityconsole 255
diagnose debug enable
Related article:
Technical Tip: SAML SSO user group setup for a managed FortiGate
