Automated Certificate Replacement Vendors - FortiADC Load Balancers

[Doug_Smith]

To automate our Layer7 VIPs which use 1 year Certificates - We are starting to look at 3rd party vendor to assist with Certificate replacement that are quickly marching towards 47 days:  https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days 

I have been doing this once a year....but to do it every month manually I cannot/do not want to imagine due to the inordinate time suck to coordinate with all the developers to validate/test...it feels like an endless loop I would rather have no part in.

Has anyone successfully used a 3rd party vendor like Digicert or Venafi to set this up with your FortiADC-VM load balancer.  It seems like they support LetsEncrypt (Open Source)/ Buypass (European) - but I would prefer to buy a product with full support.  This type of functionality seems to be quite sparse and I am having difficulty finding any products compatible with my FortiADC-VM load balancer running 7.6.2.  I understand it supports the ACME prototcol...but again....hard to find any detailed documentation on this particular subject.

Any input/guidance on this subject will be much appreciated...Thanks.

[atakannatak]

Hi @Doug_Smith ,

FortiADC already contains a native ACME client—no external script or third-party “certificate-bot” is required. you point the appliance to any ACME directory URL (Let’s Encrypt, DigiCert CertCentral, Venafi ACME, Buypass, …) and choose a validation method (DNS-01 or TLS-ALPN-01). FortiADC creates the account key, obtains the certificate, binds it to your HTTPS virtual server, and auto-renews before X-day expiry.

Fortinet-published sources confirm that (1) FortiADC’s built-in ACME client supports any standards-based ACME CA, (2) all configuration can be done directly on the FortiADC, and (3) automatic renewal is handled by the appliance itself—eliminating the need for manual certificate rollovers.

1- Step-by-step GUI wizard and description of ACME automation (“Importing a local certificate (ACME)”).

https://docs.fortinet.com/document/fortiadc/7.6.1/administration-guide/167333/importing-a-local-cert...

2- CLI syntax for execute certificate local import automated (supports custom ACME CAs).

https://docs.fortinet.com/document/fortiadc/7.6.2/cli-reference/67686/config-system-certificate-loca...

3- New-feature note describing the TLS-ALPN-01 enhancements and auto-renewal logic added in 7.6.x.

https://docs.fortinet.com/document/fortiadc/7.6.0/new-features/217485/acme-tls-alpn-01-enhancements

NOTE: Unfortunately, I haven’t had the chance to test these steps in a lab environment yet, although they appear theoretically feasible. I wanted to share this information separately.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

[Doug_Smith]

Thanks for all the information - I will report back if I have any luck getting something working with ACME.  Ironic you added the link about 7.6 enhancing the process - I am upgrading from 7.22 to 7.62 in the very near future. Much appreciated - Doug.