Client certificate help

[jasetcs]

I setup a Fortigate 60E with VPN access last week and using a cheap ssl certificate we had for a domain of ours we didn't use. I'm trying to work out how i create individual client certificates from this? I have it working where the certificate is install don fortigate and using ssl but they dont need client certificate however I'm looking to add that extra security.

The certificate i have comes with a .crt, .p7b, and ca-bundle file. I understand each client using the vpn remotely must have a client certificate that checks with the certificate installed on the fortigate.

Can i do this using open-ssl or is that not as secure as a paid certificate?

[emnoc]

Build your own  CA and sign your client's CSR. This is would I would do . As far as more secure , all CA are selfSign'd the only thing different from a publicCA and yours, is the publicCA paid money to have his certificate globally trusted by numerous OSes,Browsers,etc....

I would start here and change the  local  certificate out,  and install a privateCA  and root-cert in your clients.

http://socpuppet.blogspot.com/2015/10/fortigate-sslvpn-certificate-key.html

Than when you have a rootCA build ( openssl , MS-PKI,etc...) you sign the client's CSRs and enforce client-cert-req

Ken

[jasetcs]

thanks for the reply but bit confusing as SSL's arent my strongest point. Is there anyway i can create client certs from what I have or atlkeats 1 client cert that every user uses as we only have 2-3 remote workers