Technical Tip: How to add Subject Alternative Name (SAN) to the existing Let’s Encrypt Certificate in FortiWeb

[kmak]

Description	This article describes how to add a Subject Alternative Name (SAN) to the existing Let’s Encrypt Certificate in FortiWeb.
Scope	FortiWeb.
Solution	Prerequisite: Domain/FQDN HTTPS/HTTP must be publicly accessible when the type is HTTP-01 or TLS-ALPN. FortiWeb Let’s Encrypt SSL Certificate only supports wildcard subdomains since v7.6.1 and when the type is DNS-01. In FortiWeb, navigate to Server Objects -> Certificates -> Let’s Encrypt, and edit the existing Let’s Encrypt SSL Certificate, there will be no option to add/remove the Subject Alternative Name (SAN). To add/remove the Let’s Encrypt SSL Certificate SAN, the certificate must be revoked first. The SSL Certificate revocation will fail if the SSL Certificate is used in the Server Policy or SNI Policy. Schedule a maintenance window to unassign the Let’s Encrypt SSL Certificate from any Server Policy or SNI Policy. In the example, the SNI policy domain SSL certificate is temporarily changed from Let’s Encrypt to Local empty cert. Back to the Let’s Encrypt Certificate page and revoke the SSL certificate. The Let’s Encrypt SSL status will be changed to revoked within a minute. Edit the Let’s Encrypt SSL Certificate now and there will be options to create/edit/delete the Subject Alternative Name. Add the domain/FQDN to the Let’s Encrypt SSL Certificate SAN member list. If the Let’s Encrypt SSL Certificate type is HTTP-01, make sure that the domains/FQDN are pointed and assigned correctly to the correct Server Policy and SNI Policy before issuing the SSL certificate. If the the Let’s Encrypt SSL Certificate type is DNS-01, may just proceed to select the Issue icon for the FortiWeb system to obtain the validation TXT records. Make sure that the new domain/FQDN is added to the SNI Policy and that it is using the Let’s Encrypt SSL Certificate. The Let’s Encrypt SSL Certificate will be issued with the additional SAN count if the HTTP-validation or DNS-validation is completed successfully. Test browsing the domain website with the Let’s Encrypt SSL Certificate installed shall show the SSL Certificate with multiple certificate Subject Alternative Name (SAN). Related articles: Technical Tip: How to obtain a Let's Encrypt SSL for a domain in FortiWeb with the True Transparent ... Technical Tip: How to install Let's Encrypt SSL for version 7.0 and later (Reverse Proxy Mode)