Generating CSR, then importing signed certificate on Fortigates through FortiManager

[blazarov]

Hello,

I need to generate a CSR, then sign it from the corporate CA as SubCA to use it for SSL decryption.

I have done this many times, understand the general principles of SSL and PKI and know how to do it directly on Fortigate.

However i dont seem to find a way, neither documentation on what is the right way to do it for Fortimanager-managed Fortigates.

What i saw and tested:

1. provisioning templates->certificate templates - the explaination in documents is quite vague and ambigous, but as far as i understood and tested seems like it is only for selfsigned and using the FMGR itself as CA. am i right?

2. device management->device->vdom->system:certificates - normally these menus provide functionality very similar to directly managing the fortigate, however it seems there is only import option and no generate option through FMGR

Any ideas and suggestions are welcome!

[sw2090]

the only way I up to now found is to generate the CSR on the FGT. Have it signed by a CA and import the cert into FGT. 

Then retrieve config from FGT on FMG. 

In Policy manager create a dynamic certifcate object and add a mapping for the FGT. 

In Profiles and Policies then use that object.

This worked so far here but I might have to reconsider this since I migrated my security profiles to global adom in FMG.