SCP a certificate from my web server to FortiOS

[SCSIraidGURU1]

I have Let's Encrypt on my Ubuntu Web Server.   It generates a certificate with the firewall certificate: 
DNS Name: firewall.scsiraidguru.com DNS Name: learningwp.scsiraidguru.com DNS Name: mc.scsiraidguru.com DNS Name: patrickmckenneylandscaping.com DNS Name: scsiraidguru.com DNS Name: www.patrickmckenneylandscaping.com DNS Name: www.scsiraidguru.com

every 60-90 days.  I setup SCP account and rsa-ID on the Web Server and Fortinet 61F.   I setup a test backup file.   It can get a backup from the FortiOS and copy it back to the Web Server.   I want to automate the certificate import from the Web Server to FortiOS.   

I setup a copy.sh file that will compare the new certificate to the copy in my home cert directory.  When it changes, it copies the new pem files into my home cert directory.  It then creates a pfx file in the home cert directory.   I want to get the FortiOS to import the new certificate from the web server.   Create a new deep inspection certificate from it.   Change the policies with the new deep inspection certs for the web site.   Then, replace the other certificates that need to be updated.   I can't use FortiOS Let's Encrypt service.  I doesn't work.  The DNS record changes break the web server.   

[distillednetwork]

I created a script before that would daily take the Let's encrypt certificate on a web server and update the certificate in the FortiGate.  You can do this with a bash script that SSH into he device and runs the necessary commands and manually updates the certificate, or look at the APIs of the FortiGate and execute that way.  This will need to be something that reaches out to the FortiGate to make those changes, as opposed to something that would run on the firewall itself.  

I was not doing the DPI part of it, but if I can dig up the script could give you a starting point.

[SCSIraidGURU1]

I agree

I can ssh to the Fortinet 61F from Web Server.  I copied the RSA-ID key for the scp user to the 61F.   

fnsysctl ls -la /data/etc/cert/local shows me the certificate directory.   I am still looking for the APIs for FortiOS.  

Do you still have the script?  Can you share it?  

[distillednetwork]

I just pulled it up, and it is using the API.  Basically, I would run the script every day, upload the cert of the day (could be the same as yesterday's), and replace the web and SSL-VPN certs.  Its not perfect, but could be a good starting point.

https://github.com/distillednetworks/FGT-SSLSync

[SCSIraidGURU1]

Thanks.  You wrote it in python.  Nice.  I thought I would be doing bash commands.  

/home/<user>/certs has the pem files, key-file, and pfx

I want to get these files to import into the FortiOS.   I started looking at FortiOS API calls to do it.   

I will be posting my final solution with all the code when I am done.