Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Fortigate 80C that allows remote administration via https.

I access the URL and all fine but the one thing that really bugs me is that is brings up "untrusted connection" in chrome with the whole "click to proceed" thing.

At the moment the cert is self-signed by the Fortigate unit.

On the unit there are 5 CA signed certs for use but I cannot figure out how to assign these certs to the routers interfaces.

Does anyone know how to assign the CA signed certs to the WAN interface on port 443 so it wont ask me to confirm the cert all the time?

(I know the traffic is still encrypted but it is still nice to have)

share|improve this question

4 Answers 4

up vote 7 down vote accepted

Upload your certificates to the firewall, Fortigate certificate user guide will help you out on this. Now to use this certificate for HTTPS admin access. Use the following CLI commands:

config system global
  set admin-server-cert <certname>
end
share|improve this answer
    
Thanks, I had a hard time figuring this out. It's really weird that there doesn't seem to be a GUI option for this. –  Martijn Dec 24 '14 at 11:55

The answer is here:

http://yurisk.info/2013/05/04/disabling-ssl-deep-inspection-proxy-in-fortigate-should-be-easier/

The relevant commands is here:

FGT80C # diagnose test application ssl 5
SSL AV Bypass is now on
share|improve this answer

Okay this is what I did on 5.2 so that I could use a certificate signed by our internal CA:

  1. System->Certificates->Local Certificates->Generate (this will generate the CR)
  2. Check-click the newly created CR and Download it and process it on your favorite CA
  3. System->Certificates->Local Certificates->Import (this will import the signed cert), set Type to 'Local Certificate if it isn't already. The FortiGate should now have the CA info filled in for what was the CR.
  4. Follow instructions above for setting the certificate as the admin interface cert:

Note this article that helps a little bit. However it's a little incomplete:

  1. First do a 'conf system global'
  2. Then do a 'set admin-server-cert ?' to pull up a list
  3. Then 'set admin-server-cert < certname >' and then end
share|improve this answer

try this, http://docs.fortinet.com/fgt/archives/3.0/techdocs/FortiGate_SSL_VPN_User_Guide_01-30005-0348-20070911.pdf

share|improve this answer
2  
Sorry I downvoted, but this is a low quality answer for multiple reasons. 1) You simply provided a link with no explanation of what the link contains 2) the link goes to a 60+ page PDF without any hints as to where in the document an answer might be found 3) as best I can tell, the document does not contain an answer to the question. Link-only answers are heavily discouraged here; see meta.stackexchange.com/questions/8231 –  quux Dec 22 '11 at 7:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.