Cannot secure Fortigate public IP with CA signed certificate

[bfogliano]

I have read every article on the internet on this topic and worked with Fortinet TAC for 2 days.  All of the articles say you can secure the public IP of the Fortigate by putting the public IP in the Host IP section for the common name in the CSR.  Done this, does not work.  Once the wildcard is rekeyed for the subdomain it shows the top level domain in the cert and that it is applied on the IP login but the browser still says not secure.  I have tried this with the SAN as the DNS name for the site, and it secures the DNS name for the site but not the IP.  Has anyone successfully done this and how, and why would Fortinet documentation say this can be done if it can't (this is what TAC says and would not escalate)?

[AEK]

When generating the CSR, in the "Subject Alternative Name", did you enter the IP address directly like this: "1.2.3.4", or did you add "IP:" prefix like that: "IP:1.2.3.4"?

[ebilcari]

If a private root CA is used to sign the CSR, than usually yes it is possible to insert IP as SAN. Public root CAs will not allow to put IP in the SAN and probably will strip them out from the the CSR while signing the certificate. This is not a limitation of FGT but mostly from the root CA that is used.

[AEK]

Hi Emirjon

I think it does. Unless if google is an exception.

[ebilcari]

In this case google is self signing its own certificate so the rule doesn't apply :).

There are also some exceptions for large organization like shown here, but based on what I've seen, most of the time you can't get a public signed certificate for a public IP.

[AEK]

It makes sense. Thanks Emirjon.

[bfogliano]

Ok so the agreement is that you cannot secure a public IP with a certificate on a firewall, correct?

[AEK]

The agreement is you can but with private CA, and "probably" not with public CA.

Edit: You can still check with your public cert provider if he can do it for you.

[bfogliano]

Believe me I worked with GoDaddy for hours they were of no help. 

[AEK]

Then try find a CA that can do it, like the one shared by Emirjon.