Do u know if it's possible to use a Let's Encrypt-generated certificate into the FortiGate for the VPN Portal?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
No, I don't think that you can use LE certificates. You need their app on the device to use it. But you can use startssl
Mhe has it right.
Natively the answer is NO, but you have ways around this. Use a linux bistro build a csr/priv-key sign the csr and then export , re-import it in fortigate.
Yes any x509 compatible certificate will work in a fortigate but the native means of "let's encrypt" make it not a 1 2 3 easy-do method.
PCNSE
NSE
StrongSwan
The problem with the manual import is that you will be running the manual process probably 5 times a year as letsencrypt issuance is 90days.
"Our certificates are valid for 90 days. You can read about why here."
https://letsencrypt.org/docs/faq/
-N
So here's what I did using a raspberry pi, but can be easily used on other platforms...
[ol]
FortiGate:
[ol]System -> Config -> Certificates -> Import -> Local Certificate. Set type to Certificate. For certificate choose cert.pem and for key choose privkey.pem
VPN -> SSL -> Settings. Change Server Certificate.
Just updating this thread to mention that ACME/LetsEncrypt functionality is now built into FortiOS 7.0. New Features | FortiGate / FortiOS 7.0.0 | Fortinet Documentation Library Russ NSE7
If anyone is still looking or in need for the Letsencrypt solution for fortigate here is a working process ( was testing it for the past few weeks )
A linux VM ( CentOS 7 or 8 ) for the certbot installation and the scripts downloaded from here ( https://github.com/gdoornenbal/dehydrated-certificate-installers ) not my repository, just sharing some great work.
also if you have a hosting that is usping Cpanel, you can download this plugin so you don't need to add/remove TXT entry every time you need to issue or renew a certificate ( https://github.com/badjware/certbot-dns-cpanel )
there are also plugins for cloudflare ( https://github.com/certbot/certbot/tree/master/certbot-dns-cloudflare )
as a side note, you can split the shell script in 2 parts, one for the HTTP acces the other for the VPN, if you do so, you will need to edit this part of the script:
set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -noout -enddate | cut -d = -f 2 ]
into this
set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -enddate -nooout -in cert.pem | cut -d = -f 2 ]
when everything is ready, just setup the cronjob for the renews and you're done.
as a bonus and extra precaution you can install the cockpit package for web access to the VM and a 2FA via google authentificator whick you can setup for both SSH and cockpit access.
if someone needs help or a better clarification, just drop me a PM
update for https://github.com/absmith82/fortitools This now includes a python script for changing the certs in SSLVPN, AdminUI, User authentication?, and VIP/VIP6 (virtual servers). still needs work on deleting old certs. but can be put in post deploy scripts to upload to fortigates.
I wonder if the Fortigate could use an Automation/Stitch to self-renew the Lets Encrypt cert every 50 days or so...
That would be cool but you gave me an ideal, maybe you could craft the cert and uploaded it via the API. Just use the same key when you make the new CSR.
Ken Felix
PCNSE
NSE
StrongSwan
It looks like Stitch/Automation supports AWS Lamba or Azure Functions as actions with time based trigger .. so if I read that right then could have a Stitch call an Azure Function every X days that renews the cert file, then validates the file.
What I don't know is if the Azure Function or AWS Lamba coud return the cert through directly or if it would have to place the cert file in a location.
Optimally, once the Stitch that calls the AzFunction/AWSLamba finishes another "Action" would run that runs a Cli_Script on the fortigate that would then import the renewed Let's encrypt cert, then update the firewall SSL cert + SSLVPN cert + etc AND would log success/failure into the system event logs
// Edit ..it looks like you would need to use the generic Webhook action to get results if your goal was to have the firewall "pull" everything (vs. having the AzFunction/AWSLamba "push" into your firewall from the public cloud using firewall API calls)
So far the real problem I see is that the info on "Chaining Stitches" is missing, the section on it only talks about delays.
// Edit
BTW - here are some quick results for starting points on AzFunction or AWSLambda
Let's Encrypt SSL Certificate to Azure Functions - Microsoft Tech Community
Free SSL certificates with Certbot in AWS Lambda - Vittorio Nardone
Just updating this thread to mention that ACME/LetsEncrypt functionality is now built into FortiOS 7.0. New Features | FortiGate / FortiOS 7.0.0 | Fortinet Documentation Library Russ NSE7
V7.0 already supports "Let's Encrypt", you can try it.
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/822087/acme-certificate-support
Thanks
Kangming
has anyone tested the new LE ACME client to see if it is functional with the built-in DDNS function of fortigate where the device has a dns name of [customname].fortiddns.com ?
I tried it and am getting:
"detail": "Contacting ACME server for [customname].fortiddns.com at https://acme-v02.api.letsencrypt.org/directory: The ACME server at <https://acme-v02.api.letsencrypt.org/directory> reports that Service is Unavailable (503). This may happen during maintenance for short periods of time."
But it doesn't appear to be short-term and I can't figure what rule I might be missing to allow this traffic which I assume is getting blocked.
edit: FYI: it took about 20 minutes, but it did actually update and work. I won't delete this post so others know.
Yep, it works with fortiddns.com or float-zone.com dynamic DNS names just fine although as you noticed it does take a few minutes to complete the process during which you may see errors. I can confirm it's also fine if you have already SSL-VPN enabled on port 443 - that doesn't interfere with the ACME process.
I'm waiting to confirm that the renewal process works and that it correctly replaces the expired certificate in all the places it can get bound, e.g. admin interface, SSL-VPN, "Protect Server" SSH-SSL inspection profile, etc.
Russ
NSE7
Update: my test 7.0 system just correctly auto-renewed the fortiddns.com LE certificate 30 days before expiry as expected. The renewed 90 day certificate correctly replaced the old certificate in the Admin settings, in the SSL-VPN Portal settings and also in a "Protect Server" SSH-SSL profile. An automation stitch I had created for "A Certificate Event Occurred" correctly fired and sent me an e-mail as confirmation that the renewal happened successfully.
Russ
NSE7
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.