Created on 12-13-2016 12:57 AM
Do u know if it's possible to use a Let's Encrypt-generated certificate into the FortiGate for the VPN Portal?
Solved! Go to Solution.
Mhe has it right.
Natively the answer is NO, but you have ways around this. Use a linux bistro build a csr/priv-key sign the csr and then export , re-import it in fortigate.
Yes any x509 compatible certificate will work in a fortigate but the native means of "let's encrypt" make it not a 1 2 3 easy-do method.
So here's what I did using a raspberry pi, but can be easily used on other platforms...
System -> Config -> Certificates -> Import -> Local Certificate. Set type to Certificate. For certificate choose cert.pem and for key choose privkey.pem
VPN -> SSL -> Settings. Change Server Certificate.
If anyone is still looking or in need for the Letsencrypt solution for fortigate here is a working process ( was testing it for the past few weeks )
A linux VM ( CentOS 7 or 8 ) for the certbot installation and the scripts downloaded from here ( https://github.com/gdoornenbal/dehydrated-certificate-installers ) not my repository, just sharing some great work.
also if you have a hosting that is usping Cpanel, you can download this plugin so you don't need to add/remove TXT entry every time you need to issue or renew a certificate ( https://github.com/badjware/certbot-dns-cpanel )
there are also plugins for cloudflare ( https://github.com/certbot/certbot/tree/master/certbot-dns-cloudflare )
as a side note, you can split the shell script in 2 parts, one for the HTTP acces the other for the VPN, if you do so, you will need to edit this part of the script:
set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -noout -enddate | cut -d = -f 2 ]
set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -enddate -nooout -in cert.pem | cut -d = -f 2 ]
when everything is ready, just setup the cronjob for the renews and you're done.
as a bonus and extra precaution you can install the cockpit package for web access to the VM and a 2FA via google authentificator whick you can setup for both SSH and cockpit access.
if someone needs help or a better clarification, just drop me a PM
update for https://github.com/absmith82/fortitools This now includes a python script for changing the certs in SSLVPN, AdminUI, User authentication?, and VIP/VIP6 (virtual servers). still needs work on deleting old certs. but can be put in post deploy scripts to upload to fortigates.
That would be cool but you gave me an ideal, maybe you could craft the cert and uploaded it via the API. Just use the same key when you make the new CSR.
It looks like Stitch/Automation supports AWS Lamba or Azure Functions as actions with time based trigger .. so if I read that right then could have a Stitch call an Azure Function every X days that renews the cert file, then validates the file.
What I don't know is if the Azure Function or AWS Lamba coud return the cert through directly or if it would have to place the cert file in a location.
Optimally, once the Stitch that calls the AzFunction/AWSLamba finishes another "Action" would run that runs a Cli_Script on the fortigate that would then import the renewed Let's encrypt cert, then update the firewall SSL cert + SSLVPN cert + etc AND would log success/failure into the system event logs
// Edit ..it looks like you would need to use the generic Webhook action to get results if your goal was to have the firewall "pull" everything (vs. having the AzFunction/AWSLamba "push" into your firewall from the public cloud using firewall API calls)
So far the real problem I see is that the info on "Chaining Stitches" is missing, the section on it only talks about delays.
BTW - here are some quick results for starting points on AzFunction or AWSLambda
has anyone tested the new LE ACME client to see if it is functional with the built-in DDNS function of fortigate where the device has a dns name of [customname].fortiddns.com ?
I tried it and am getting:
"detail": "Contacting ACME server for [customname].fortiddns.com at https://acme-v02.api.letsencrypt.org/directory: The ACME server at <https://acme-v02.api.letsencrypt.org/directory> reports that Service is Unavailable (503). This may happen during maintenance for short periods of time."
But it doesn't appear to be short-term and I can't figure what rule I might be missing to allow this traffic which I assume is getting blocked.
edit: FYI: it took about 20 minutes, but it did actually update and work. I won't delete this post so others know.
Yep, it works with fortiddns.com or float-zone.com dynamic DNS names just fine although as you noticed it does take a few minutes to complete the process during which you may see errors. I can confirm it's also fine if you have already SSL-VPN enabled on port 443 - that doesn't interfere with the ACME process.
I'm waiting to confirm that the renewal process works and that it correctly replaces the expired certificate in all the places it can get bound, e.g. admin interface, SSL-VPN, "Protect Server" SSH-SSL inspection profile, etc.
Update: my test 7.0 system just correctly auto-renewed the fortiddns.com LE certificate 30 days before expiry as expected. The renewed 90 day certificate correctly replaced the old certificate in the Admin settings, in the SSL-VPN Portal settings and also in a "Protect Server" SSH-SSL profile. An automation stitch I had created for "A Certificate Event Occurred" correctly fired and sent me an e-mail as confirmation that the renewal happened successfully.