Remove Certificate Error when connecting locally to Fortigate

[kylehouk]

I am trying to make it so that when I connect to the Fortigate from an internal subnet that I do not get a certificate error from the web browser.

I have purchased a domain and have used the ACME feature to get a CA Certificate from Let's Encrypt. I then set that certificate as the HTTPS server certificate. However, when accessing from IP address I still get a certificate error and when I try connecting using the FQDN I issued with the cert it does not resolve and I cannot connect to the Fortigate.

I don't want to have download and install anything in the browser if I don't have too, but if that is the only option then it what it is.

But, I feel like I'm missing something but despite by best efforts I can't seem to figure out what that is.

[Toshi_Esumi]

It's not possible if you use like "https://192.168.1.99/login" because it doesn't include any domain name. And, it has nothing to do with the FGT but your browser side deciding to show the warning. Only thing you could do is to use HTTP instead, which I don't recommend.

Just accept the fact you're not using your domain name to access it and the warning should show up because the browser can't verify the authenticity of the destination.

Toshi

[ndumaj]

Hello,
What is the error that you receives?
There a few https warnings you should identify them by running a PCAP on client and FGT as well.
Also review the following guide:
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/822087/automatically-provisi...

Related articles:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Import-certificate-directly-to-cert-manage...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Untrusted-certificate-warning-in-FortiGate...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-an-SSL-certificate-as-a-loca...
BR

[TecnetRuss]

So the cert warning is because you're not connecting via the same FQDN (fully qualified domain name) as the certificate, and you can't connect via that FQDN because it doesn't resolve to the FortiGate's internal IP?  That can be fixed a number of different ways.

If you are managing this from a workstation that is using Active Directory DNS internally, you can create a DNS A record (if you already have split-brain DNS for internal/external) or a DNS forward-lookup zone for that FQDN that resolves the name to the internal IP address.  How you do this depends on your internal DNS configuration.

Alternatively, if you really only need this in place for one management workstation, you can simply create an entry in that workstation's HOSTS file that resolves the FQDN to the internal IP.  On a windows system that is done as follows:

1. Open an Administrator command prompt.
2. cd \windows\system32\drivers\etc
3. notepad hosts
4. Add a line like "192.168.1.1  firewall.corp.example.com" (substituting your FortiGate's internal IP and the FQDN of the FortiGate and LE certificate).
5. Save the file.

Now you should be able to access the FortiGate's admin interface via https://firewall.corp.example.com without any certificate warnings.

[kylehouk]

To remove the certificate error I had to setup the DNS server on the Fortigate and enable it on the interface where I want the certificate to be valid and then add a DNS entry into the DNS Server that points the interface IP to the FQDN.