Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
aseques
Contributor

Created on ‎07-02-2015 03:21 AM

Fortigate ssl proxy private keys are different on every backup, diffing not possible

I have a little script that uses scp to download the current configuration to my server, there's a second part of the script that does a diff with both files and warns me when there have been modifications.

I am having an issue with the  private keys for "Fortinet_CA_SSLProxy"  and for "Fortinet_SSLProxy", weird enough the certificates are the same all the time, so i'm a bit lost here. Aren't the backups mean to be identical? (other than the  conf_file_ver)?

 

Labels:
11119
0 Kudos
1 Solution
jmlux
New Contributor III

Created on ‎08-10-2015 05:48 AM

I haven't asked support (yet), but I have found out the following:

 

Different types of configuration output / backup are available (output=backup in this case since everything is a text file, kudos, Fortinet):

[ul]
  • show (like backup but without certificates)
  • show full (very verbose, includes default config, and always changing stuff)
  • execute backup (like "show" but with certificates)[/ul]

    You only notice stuff changing when comparing different "show full"s.

    Meaning: Since "execute backup" (=the backup function in the GUI) is not a lot more verbose than a simple "show", it follows from that that the always changing information is not required to accomplish an actual restore. So why back it up?

     

    Now those findings would have to be confirmed by someone ;)

    • View solution in original post

    5181
    0 Kudos
    11 REPLIES 11
    jmlux
    New Contributor III
    In response to aseques

    Created on ‎02-14-2016 11:28 AM

    According to my previous statement that "show" didn't include cycling private keys and/or certificates, I found out that this is not always true. It seems true on e.g. a 100D/FOS5.2.5 (no vdoms), but not a 400D/FOS5.2.6 (with vdoms)...

    475
    0 Kudos
    aseques
    Contributor
    In response to jmlux

    Created on ‎02-14-2016 11:56 PM

    The solution I am using with the diffed config files is still working fortunately (not tried with 5.2.6 yet), so until fortigate allows a proper scp backup download I'll keep using this method.

    Thanks for testing in 5.2.6

    475
    0 Kudos
    Announcements
    Check out our Community Chatter Blog! Click here to get involved
    Labels
    Top Kudoed Authors
    View all
    Broad. Integrated. Automated.

    The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

    Social Media
    Security Research
    Company
    News & Articles
    Contact Us

    Copyright 2025 Fortinet, Inc. All Rights Reserved.