3

I have a Fortigate 80C that allows remote administration via https.

I access the URL and all fine but the one thing that really bugs me is that is brings up "untrusted connection" in chrome with the whole "click to proceed" thing.

At the moment the cert is self-signed by the Fortigate unit.

On the unit there are 5 CA signed certs for use but I cannot figure out how to assign these certs to the routers interfaces.

Does anyone know how to assign the CA signed certs to the WAN interface on port 443 so it wont ask me to confirm the cert all the time?

(I know the traffic is still encrypted but it is still nice to have)

4 Answers 4

9

Upload your certificates to the firewall, Fortigate certificate user guide will help you out on this. Now to use this certificate for HTTPS admin access. Use the following CLI commands:

config system global
  set admin-server-cert <certname>
end
1
  • Thanks, I had a hard time figuring this out. It's really weird that there doesn't seem to be a GUI option for this.
    – Martijn
    Dec 24, 2014 at 11:55
2

Okay this is what I did on 5.2 so that I could use a certificate signed by our internal CA:

  1. System->Certificates->Local Certificates->Generate (this will generate the CR)
  2. Check-click the newly created CR and Download it and process it on your favorite CA
  3. System->Certificates->Local Certificates->Import (this will import the signed cert), set Type to 'Local Certificate if it isn't already. The FortiGate should now have the CA info filled in for what was the CR.
  4. Follow instructions above for setting the certificate as the admin interface cert:

Note this article that helps a little bit. However it's a little incomplete:

  1. First do a 'conf system global'
  2. Then do a 'set admin-server-cert ?' to pull up a list
  3. Then 'set admin-server-cert < certname >' and then end
3
0

The answer is here:

http://yurisk.info/2013/05/04/disabling-ssl-deep-inspection-proxy-in-fortigate-should-be-easier/

The relevant commands is here:

FGT80C # diagnose test application ssl 5
SSL AV Bypass is now on
1
  • This seems to be for another problem: Using packet inspection on encrypted data passing through Sep 14, 2016 at 19:27
-2

try this, http://docs.fortinet.com/fgt/archives/3.0/techdocs/FortiGate_SSL_VPN_User_Guide_01-30005-0348-20070911.pdf

1
  • 2
    Sorry I downvoted, but this is a low quality answer for multiple reasons. 1) You simply provided a link with no explanation of what the link contains 2) the link goes to a 60+ page PDF without any hints as to where in the document an answer might be found 3) as best I can tell, the document does not contain an answer to the question. Link-only answers are heavily discouraged here; see meta.stackexchange.com/questions/8231
    – quux
    Dec 22, 2011 at 7:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .