Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Alby23
Contributor II

Let's Encrypt and FortiGate

Do u know if it's possible to use a Let's Encrypt-generated certificate into the FortiGate for the VPN Portal?

5 Solutions
mhe
Contributor

No, I don't think that you can use LE certificates. You need their app on the device to use it. But you can use startssl

View solution in original post

emnoc
Esteemed Contributor III

Mhe has it right.

 

Natively the answer is NO, but you have ways around this. Use a linux bistro build a csr/priv-key sign the csr and then export , re-import it in fortigate.

 

Yes any x509 compatible certificate will work in  a fortigate but the native means of "let's encrypt" make it not a 1 2 3  easy-do  method.

PCNSE 

NSE 

StrongSwan  

View solution in original post

NeilG

The problem with the manual import is that you will be running the manual process probably 5 times a year as letsencrypt issuance is 90days.

"Our certificates are valid for 90 days. You can read about why here."

https://letsencrypt.org/docs/faq/

 

-N

View solution in original post

jtfinley

So here's what I did using a raspberry pi, but can be easily used on other platforms...

 

 

[ol]
  • Install letsencrypt (https://letsencrypt.org/getting-started) on a box with tcp/80, tcp/443 open. (Raspberry Pi - used CertBot)
  • Temporarily point a DNS A or CNAME record of your (Raspberry Pi Box) SSL VPN at the box you're going to run letsencrypt on.
  • Once it pulls dependencies - Run letsencrypt using example below.
  • [ol]
  •  ./certbot-auto certonly --standalone -d vpn.yoursite.com -d [[/ol]
  • Change DNS records if required by pointing your DNS A record back at your SSL VPN IP
  • Grab your pems from /etc/letsencrypt/live/vpn.yoursite.com (cert.pem & privkey.pem) [/ol]

    FortiGate:

    [ol]
  • System -> Config -> Certificates -> Import -> Local Certificate. Set type to Certificate. For certificate choose cert.pem and for key choose privkey.pem

  • VPN -> SSL -> Settings. Change Server Certificate.

  • Repeat process every 90 days
  • Setup CronJob to renew it.[/ol]
  • View solution in original post

    TecnetRuss

    Just updating this thread to mention that ACME/LetsEncrypt functionality is now built into FortiOS 7.0. New Features | FortiGate / FortiOS 7.0.0 | Fortinet Documentation Library Russ NSE7

    View solution in original post

    46 REPLIES 46
    Ebuic
    New Contributor

    If anyone is still looking or in need for the Letsencrypt solution for fortigate here is a working process ( was testing it for the past few weeks )

     

    A linux VM ( CentOS 7 or 8 ) for the certbot installation and the scripts downloaded from here ( https://github.com/gdoornenbal/dehydrated-certificate-installers ) not my repository, just sharing some great work.

     

    also if you have a hosting that is usping Cpanel, you can download this plugin so you don't need to add/remove TXT entry every time you need to issue or renew a certificate ( https://github.com/badjware/certbot-dns-cpanel )

     

    there are also plugins for cloudflare ( https://github.com/certbot/certbot/tree/master/certbot-dns-cloudflare )

     

    as a side note, you can split the shell script in 2 parts, one for the HTTP acces the other for the VPN, if you do so, you will need to edit this part of the script:

     

    set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -noout -enddate | cut -d = -f 2 ]

     

    into this

     

    set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -enddate -nooout -in cert.pem | cut -d = -f 2 ]

     

    when everything is ready, just setup the cronjob for the renews and you're done.

     

    as a bonus and extra precaution you can install the cockpit package for web access to the VM and a 2FA via google authentificator whick you can setup for both SSH and cockpit access.

     

    if someone needs help or a better clarification, just drop me a PM

    absmith
    New Contributor

    update for https://github.com/absmith82/fortitools This now includes a python script for changing the certs in SSLVPN, AdminUI, User authentication?, and VIP/VIP6 (virtual servers).   still needs work on deleting old certs. but can be put in post deploy scripts to upload to fortigates.

     

     

    NeilG

    I wonder if the Fortigate could use an Automation/Stitch to self-renew the Lets Encrypt cert every 50 days or so... 

    emnoc
    Esteemed Contributor III

    That would be cool but you gave me an ideal, maybe you could craft the cert and uploaded it via the API. Just use the same key when you make the new CSR.

     

    Ken Felix

    PCNSE 

    NSE 

    StrongSwan  

    NeilG

    It looks like Stitch/Automation supports AWS Lamba or Azure Functions as actions with time based trigger .. so if I read that right then could have a Stitch call an Azure Function every X days that renews the cert file, then validates the file. 

    What I don't know is if the Azure Function or AWS Lamba coud return the cert through directly or if it would have to place the cert file in a location.

     

    Optimally, once the Stitch that calls the AzFunction/AWSLamba finishes another "Action" would run that runs a Cli_Script on  the fortigate that would then import the renewed Let's encrypt cert, then update the firewall SSL cert + SSLVPN cert + etc  AND would log success/failure into the system event logs 

     

    // Edit ..it looks like you would need to use the generic Webhook action to get results if your goal was to have the firewall "pull" everything  (vs. having the AzFunction/AWSLamba "push" into your firewall from the public cloud using firewall API calls)

     

    So far the real problem I see is that the info on "Chaining Stitches" is missing, the section on it only talks about delays.

     

    https://docs.fortinet.com/document/fortigate/latest/administration-guide/137181/chaining-and-delayin...

     

    // Edit 

    BTW - here are some quick results for starting points on AzFunction or AWSLambda

    GitHub - MarcStan/lets-encrypt-azure: Azure function based Let's Encrypt automation for Azure CDN & ...

    Let's Encrypt SSL Certificate to Azure Functions - Microsoft Tech Community

     

    Free SSL certificates with Certbot in AWS Lambda - Vittorio Nardone

     

     

    TecnetRuss

    Just updating this thread to mention that ACME/LetsEncrypt functionality is now built into FortiOS 7.0. New Features | FortiGate / FortiOS 7.0.0 | Fortinet Documentation Library Russ NSE7

    Kangming
    Staff
    Staff
    trump26901

    has anyone tested the new LE ACME client to see if it is functional with the built-in DDNS function of fortigate where the device has a dns name of [customname].fortiddns.com ?  

     

    I tried it and am getting:

    "detail": "Contacting ACME server for [customname].fortiddns.com at https://acme-v02.api.letsencrypt.org/directory: The ACME server at <https://acme-v02.api.letsencrypt.org/directory> reports that Service is Unavailable (503). This may happen during maintenance for short periods of time."

     

    But it doesn't appear to be short-term and I can't figure what rule I might be missing to allow this traffic which I assume is getting blocked.

     

     

    edit:  FYI:  it took about 20 minutes, but it did actually update and work.   I won't delete this post so others know.

    TecnetRuss

    Yep, it works with fortiddns.com or float-zone.com dynamic DNS names just fine although as you noticed it does take a few minutes to complete the process during which you may see errors.  I can confirm it's also fine if you have already SSL-VPN enabled on port 443 - that doesn't interfere with the ACME process.

     

    I'm waiting to confirm that the renewal process works and that it correctly replaces the expired certificate in all the places it can get bound, e.g. admin interface, SSL-VPN, "Protect Server" SSH-SSL inspection profile, etc.

     

    Russ

    NSE7

    TecnetRuss

    Update: my test 7.0 system just correctly auto-renewed the fortiddns.com LE certificate 30 days before expiry as expected.  The renewed 90 day certificate correctly replaced the old certificate in the Admin settings, in the SSL-VPN Portal settings and also in a "Protect Server" SSH-SSL profile.  An automation stitch I had created for "A Certificate Event Occurred" correctly fired and sent me an e-mail as confirmation that the renewal happened successfully.

     

    Russ

    NSE7