aethercert
Firewalls

Automated certificate import for Fortinet FortiGate

SSL VPN portals and FortiGate admin interfaces need publicly trusted certificates, and FortiOS will not renew them for you. The FortiGate package imports each renewed certificate over the REST API.

Get started free Manual replacement guide
The deployment steps defined in this package's manifest.

At a glance

Package
fortigate-target 2.0.0
Compatibility
FortiGate / FortiOS >=6.4 <8.0
Runs from
Any Windows or Linux agent with network access to it
Mechanism
REST API
Authentication
API token
Capabilities
Import certificate and key
Deployment steps
importGlobal* → importVdom*
Rollback
None
Key usage
No requirement

* conditional step

What it does

An agent on your network calls the FortiOS REST API with an API token and imports the certificate and key as a local certificate under the configured name - globally, or into a specific VDOM.

Where the certificate is used - SSL VPN, admin HTTPS, SSL inspection - is configured on the FortiGate by referencing that certificate name.

How it runs

  1. 01

    importGlobal

    The certificate is imported in the global scope when no VDOM is set.

  2. 02

    importVdom

    The certificate is imported into the configured VDOM.

What you configure

  • Management host and port
  • REST API token (stored encrypted)
  • Certificate name
  • Optional VDOM

Prerequisites

  • An agent with network access to the FortiGate management interface
  • A REST API administrator with permission to import certificates
  • Trusted host settings on the API admin that include the agent's address

Limitations

  • Assigning the certificate to SSL VPN, admin access or inspection profiles is configured on the FortiGate.

Doing it by hand

The documentation has a step-by-step guide for replacing this certificate manually - useful for a first install, or to see exactly what the package automates.

Manual replacement guide

Related features

Certificate deploymentInstall renewed certificates into IIS, Exchange, NetScaler and other targets.Automated renewalRenew on schedule from ACME, AD CS or a commercial CA.Target RegistrySigned, versioned deployment packages - and your own.

Solutions

Firewalls and load balancersNetScaler, F5, FortiGate, PAN-OS and more over their APIs.47-day certificatesRenew and deploy before shorter lifetimes break manual processes.

More in Firewalls

Palo Alto Networks PAN-OSImport the keypair over the XML API, then commit.Sophos FirewallUpload through the Sophos Firewall XML API.WatchGuard FireboxCreate and install through the WatchGuard Cloud API.Cisco Secure Firewall Management CenterCreate or update the internal certificate object, then deploy.

All integrations

Documentation

Frequently asked questions

Fortinet FortiGate

Which FortiOS versions are supported?

The package declares FortiOS 6.4 up to (not including) 8.0.

Does it work with VDOMs?

Yes. Set a VDOM to import there; leave it empty to import globally.

Automate Fortinet FortiGate

Enroll an agent, attach the package, and the next renewal installs itself.

Get started free All integrations

Community plan, no card required. Open registration - your account is ready in a few minutes.