Lets Encrypt with Virtual Server

[sysram]

Hi

We have a Virtual Server only with HTTPS.
Now we upgraded to 7.0.6 and I read that it would be possible to use the newly implemented ACME client.
So I tried to get a LE certificate with the GUI but I always get the error:

Timeout during connect (likely firewall problem)

I know LE very well and normally the verification will be passed on the webserver.
So I'm confused how the forti will catch the LE requese on Port 80 and answer it correctly

[pminarik]

I haven't gotten around to test it to personally confirm, but my impression from all discussions I've seen so far has been that the validation port must be either unused, or at most used by the admin GUI (in which case the httpsd process can decide whether a request is a letsencrypt validation attempt, or access to the GUI). In other words, a VIP sending ports 80/443 off to elsewhere will block the validation from succeeding.

[sysram]

Ok I forgot one detail.
We have a lot of public IPs.
The IP and URL which I want to use is only configured as a Virtual Server

It is not binded to an Interface

[pminarik]

For a plain VIP, this would be a clear "not supported", for server-load-balance VIPs (virtual server), I would not be too sure. With that said, the documentation says "no VIPs" - https://docs.fortinet.com/document/fortigate/7.0.0/new-features/822087/acme-certificate-support

[sysram]

Well if Virtual Servers are not supported, then this ACME integration is not really good.
I was able to use it for SSL VPN. But we have a lot of VIPs and VS. So they should do a better implementation.

[kostixxa]

Totally agree, If ACME is suitable only for SSLVPN and Fortigate itself than it is almost useless. 

[pminarik]

For proper reverse-proxying, there seems to be push towards FortiWeb or FortiADC.

FortiGate's reverse-proxy (server-load-balancing VIP) is rather simple. And it would seem that ACME is intended to be used mainly for web-GUI or SSL-VPN.