Managing Digital Certificates; Obtaining A Signed Local Certificate - Fortinet FortiGate 50A Installation And Configuration Manual

Managing digital certificates

Managing digital certificates

Obtaining a signed local certificate

190
Use digital certificates to make sure that both participants in an IPSec communication
session are trustworthy, prior to setting up an encrypted VPN tunnel between the
participants.
Fortinet uses a manual procedure to obtain certificates. This involves copying and
pasting text files from your local computer to the certificate authority, and from the
certificate authority to your local computer.
• Obtaining a signed local certificate
• Obtaining CA certificates
Note: Digital certificates are not required for configuring FortiGate VPNs. Digital certificates are
an advanced feature provided for the convenience of system administrators. This manual
assumes the user has prior knowledge of how to configure digital certificates for their
implementation.
The signed local certificate provides the FortiGate unit with a means to authenticate
itself to other devices.
Note: The VPN peers must use digital certificates that adhere to the X.509 standard.
Generating the certificate request
With this procedure, you generate a private and public key pair. The public key is the
base component of the certificate request.
To generate the certificate request
1 Go to VPN > Certificates > Local Certificates.
2 Select Generate.
3 Type a Certificate Name.
The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and
the special characters - and _. Other special characters and spaces are not allowed.
4 Configure the Subject Information that identifies the object being certified.
Preferably use an IP address or domain name. If this is impossible (such as with a
dialup client), use an email address.
Host IP
Domain Name
E-Mail
5 Configure the Optional Information to further identify the object being certified.
For Host IP, enter the IP address of the FortiGate unit being certified.
For Domain name, enter the fully qualified domain name of the FortiGate
unit being certified. Do not include the protocol specification (http://) or
any port number or path names.
For E-mail, enter the email address of the owner of the FortiGate unit
being certified. Typically, e-mail addresses are entered only for clients, not
gateways.
IPSec VPN
Fortinet Inc.