Imported Let's Encrypt certificate not showing in "Service Provider Configuration" (FortiGate 7.6.4)

[gmessina]

Hi everyone,

I’m having an issue with my SSL/TLS certificate when setting up a captive portal for Wi-Fi authentication.

1. I imported my company domain certificate (fullchain.pem and privkey.pem) under System > Certificates. 2. The import works fine, it shows valid dates, status OK, and everything looks good.

3. The certificate also appears correctly under System > Settings > HTTPS Server Certificate and under Server Certificate.

However, when I try to configure Single Sign-On (Service Provider Configuration), the certificate does not appear in the list.

This certificate was generated using Let’s Encrypt (Certbot) and it’s a wildcard certificate.
My FortiGate is running version 7.6.4.

I want to use this certificate for the Wi-Fi captive portal, so that users are redirected to a company domain like auth.wifi.company.com during authentication.

Has anyone experienced this before or knows why the certificate doesn’t show up in the Service Provider Configuration section?

Thanks in advance!

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello gmessina,

I found this solution. Can you tell us if it helps, please?

The issue you're experiencing with the certificate not appearing in the Single Sign-On (SSO) Service Provider Configuration is likely due to the key type of the certificate. According to the provided context, the Service Provider Certificate key type must be RSA for it to appear in the drop-down list in SSO settings.

Here's what you can do to resolve the issue:

1. Check the Key Type: Verify the key type of your certificate. If it was generated using Let's Encrypt (certbot), it might be using ECDSA by default.
   
   

2. Regenerate the Certificate: If the key type is ECDSA, you will need to regenerate the certificate using RSA. You can do this by using the following certbot switch:
   
   

   --key-type RSA
   

3. Re-import the Certificate: Once you have regenerated the certificate with an RSA key, import it again under System > Certificates.
   
   

4. Verify Appearance in SSO Settings: After re-importing, check if the certificate now appears in the Service Provider Configuration section.
   
   

By ensuring the certificate uses an RSA key, it should appear in the SSO settings as required.