FortiSiem Web access change self-signed certificate

[networkm]

Hello,

I have production enviroment with supervisor,collector and windows agents.I am using self-signed certificate for web acccess to supervisor. I need to use certificate digitaly signed with my own private CA so when i access fortisiem to not getting warning.

Does anyone have solution how to generate csr,sign it, and import certiciate in suppervisor to be used for web (because there is no option in GUI like for example in fortigate).

Also if i do that will it have impact for communication collector to supervisor, or agent to collector ?

Thanks everyone 

[Gabe_FTNT]

@networkm
This FortiSIEM technical tip should help you: How to apply a self-signed or certificate authority 

[networkm]

@Gabe_FTNT 

Thank you. If i follow this steps and replace self-signed with new digitaly signed certificate by my CA, will that create some impact on existing communication between collector--supervisor, and between agents--collector.

Note: everything is discovered and login in collector and agents is also connected to collector.

[Gabe_FTNT]

I'm not sure, as I haven't worked with it for a few years. I just had that link readily available when I saw your post. :smiling_face_with_smiling_eyes:
Please study the technical tip: How to check communication between collector and super from collector side that's linked in the previously shared link, as well as the documentation for the FortiSIEM version you're using, e.g. for 7.5.0: Configuring SSL Socket Certificates

[Secusaurus]

Hi @networkm,

Unless you haven't configured otherwise, the Collectors and Workers will accept any kind of certificate (they accept the self-signed in the first place, so there is no need apply the CA to them here). You can enforce the certificate check, but this is not the default situation.

In our usual setups, we have a slightly different situation (we sign with public CAs and we do certificate stuff before growing the cluster), so I'd recommend you to schedule a maintenance window to be able to roll back and check.

Also, note, that some applications only do a certificate check from time to time, so it might take a day (or a reboot of all nodes) to ensure that everything works with the new certificates.

Best,

Christian