Let's Encrypt and FortiGate

[Alby23]

Do u know if it's possible to use a Let's Encrypt-generated certificate into the FortiGate for the VPN Portal?

[mhe · Accepted solution]

No, I don't think that you can use LE certificates. You need their app on the device to use it. But you can use startssl

[emnoc · Accepted solution]

Mhe has it right.

Natively the answer is NO, but you have ways around this. Use a linux bistro build a csr/priv-key sign the csr and then export , re-import it in fortigate.

Yes any x509 compatible certificate will work in  a fortigate but the native means of "let's encrypt" make it not a 1 2 3  easy-do  method.

[NeilG · Accepted solution]

The problem with the manual import is that you will be running the manual process probably 5 times a year as letsencrypt issuance is 90days.

"Our certificates are valid for 90 days. You can read about why here."

https://letsencrypt.org/docs/faq/

-N

[jtfinley · Accepted solution]

So here's what I did using a raspberry pi, but can be easily used on other platforms...

[ol]

Install letsencrypt (https://letsencrypt.org/getting-started) on a box with tcp/80, tcp/443 open. (Raspberry Pi - used CertBot)

Temporarily point a DNS A or CNAME record of your (Raspberry Pi Box) SSL VPN at the box you're going to run letsencrypt on.

Once it pulls dependencies - Run letsencrypt using example below.

[ol]

 ./certbot-auto certonly --standalone -d vpn.yoursite.com -d [[/ol]

Change DNS records if required by pointing your DNS A record back at your SSL VPN IP

Grab your pems from /etc/letsencrypt/live/vpn.yoursite.com (cert.pem & privkey.pem) [/ol]

FortiGate:

[ol]

System -> Config -> Certificates -> Import -> Local Certificate. Set type to Certificate. For certificate choose cert.pem and for key choose privkey.pem

VPN -> SSL -> Settings. Change Server Certificate.

Repeat process every 90 days

Setup CronJob to renew it.[/ol]

[Ebuic]

If anyone is still looking or in need for the Letsencrypt solution for fortigate here is a working process ( was testing it for the past few weeks )

A linux VM ( CentOS 7 or 8 ) for the certbot installation and the scripts downloaded from here ( https://github.com/gdoornenbal/dehydrated-certificate-installers ) not my repository, just sharing some great work.

also if you have a hosting that is usping Cpanel, you can download this plugin so you don't need to add/remove TXT entry every time you need to issue or renew a certificate ( https://github.com/badjware/certbot-dns-cpanel )

there are also plugins for cloudflare ( https://github.com/certbot/certbot/tree/master/certbot-dns-cloudflare )

as a side note, you can split the shell script in 2 parts, one for the HTTP acces the other for the VPN, if you do so, you will need to edit this part of the script:

set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -noout -enddate | cut -d = -f 2 ]

into this

set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -enddate -nooout -in cert.pem | cut -d = -f 2 ]

when everything is ready, just setup the cronjob for the renews and you're done.

as a bonus and extra precaution you can install the cockpit package for web access to the VM and a 2FA via google authentificator whick you can setup for both SSH and cockpit access.

if someone needs help or a better clarification, just drop me a PM

[absmith]

update for https://github.com/absmith82/fortitools This now includes a python script for changing the certs in SSLVPN, AdminUI, User authentication?, and VIP/VIP6 (virtual servers).   still needs work on deleting old certs. but can be put in post deploy scripts to upload to fortigates.

[NeilG]

I wonder if the Fortigate could use an Automation/Stitch to self-renew the Lets Encrypt cert every 50 days or so... 

[emnoc]

That would be cool but you gave me an ideal, maybe you could craft the cert and uploaded it via the API. Just use the same key when you make the new CSR.

Ken Felix

[NeilG]

It looks like Stitch/Automation supports AWS Lamba or Azure Functions as actions with time based trigger .. so if I read that right then could have a Stitch call an Azure Function every X days that renews the cert file, then validates the file. 

What I don't know is if the Azure Function or AWS Lamba coud return the cert through directly or if it would have to place the cert file in a location.

Optimally, once the Stitch that calls the AzFunction/AWSLamba finishes another "Action" would run that runs a Cli_Script on  the fortigate that would then import the renewed Let's encrypt cert, then update the firewall SSL cert + SSLVPN cert + etc  AND would log success/failure into the system event logs 

// Edit ..it looks like you would need to use the generic Webhook action to get results if your goal was to have the firewall "pull" everything  (vs. having the AzFunction/AWSLamba "push" into your firewall from the public cloud using firewall API calls)

So far the real problem I see is that the info on "Chaining Stitches" is missing, the section on it only talks about delays.

https://docs.fortinet.com/document/fortigate/latest/administration-guide/137181/chaining-and-delayin...

// Edit 

BTW - here are some quick results for starting points on AzFunction or AWSLambda

GitHub - MarcStan/lets-encrypt-azure: Azure function based Let's Encrypt automation for Azure CDN & ...

Let's Encrypt SSL Certificate to Azure Functions - Microsoft Tech Community

Free SSL certificates with Certbot in AWS Lambda - Vittorio Nardone

[TecnetRuss · Accepted solution]

Just updating this thread to mention that ACME/LetsEncrypt functionality is now built into FortiOS 7.0. New Features | FortiGate / FortiOS 7.0.0 | Fortinet Documentation Library Russ NSE7

[Kangming]

V7.0 already supports "Let's Encrypt", you can try it.

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/822087/acme-certificate-support

[trump26901]

has anyone tested the new LE ACME client to see if it is functional with the built-in DDNS function of fortigate where the device has a dns name of [customname].fortiddns.com ?  

I tried it and am getting:

"detail": "Contacting ACME server for [customname].fortiddns.com at https://acme-v02.api.letsencrypt.org/directory: The ACME server at <https://acme-v02.api.letsencrypt.org/directory> reports that Service is Unavailable (503). This may happen during maintenance for short periods of time."

But it doesn't appear to be short-term and I can't figure what rule I might be missing to allow this traffic which I assume is getting blocked.

edit:  FYI:  it took about 20 minutes, but it did actually update and work.   I won't delete this post so others know.

[TecnetRuss]

Yep, it works with fortiddns.com or float-zone.com dynamic DNS names just fine although as you noticed it does take a few minutes to complete the process during which you may see errors.  I can confirm it's also fine if you have already SSL-VPN enabled on port 443 - that doesn't interfere with the ACME process.

I'm waiting to confirm that the renewal process works and that it correctly replaces the expired certificate in all the places it can get bound, e.g. admin interface, SSL-VPN, "Protect Server" SSH-SSL inspection profile, etc.

Russ

NSE7

[TecnetRuss]

Update: my test 7.0 system just correctly auto-renewed the fortiddns.com LE certificate 30 days before expiry as expected.  The renewed 90 day certificate correctly replaced the old certificate in the Admin settings, in the SSL-VPN Portal settings and also in a "Protect Server" SSH-SSL profile.  An automation stitch I had created for "A Certificate Event Occurred" correctly fired and sent me an e-mail as confirmation that the renewal happened successfully.

Russ

NSE7