Generating CSR with SAN in FortiGate CLI

Securing administrative access to your FortiGate firewall is critical, especially when accessing the GUI over HTTPS. One common issue administrators face is browser warnings caused by missing or incorrect Subject Alternative Name (SAN) entries in SSL certificates.

Let’s go through generating a Certificate Signing Request (CSR) with SAN using the FortiGate CLI, so you can install a trusted certificate and securely access the FortiGate GUI without browser errors.

Syntax to follow:

#execute vpn certificate [store] generate [encryption_method] [certificate_name] [key_size] [Host IP/Domain Name/E-Mail] [Country Name or Code] [State/Province] [City] [Organization] [Organization Unit] [Email] [SANs]

• store: local [options are ca, crl, local, remote]
• encryption_method: rsa [rsa, elliptic curve]
• cert_name: Name for Certificate, purely meant as an indentifier
• key_Size: Key Encyrption Size, Options are 1024, 1536, 2048, 4096
• Host IP/Domain Name/E-Mail: Common Name, the name the certificate is signed for
• Country: Country name or Country Code such as CA (Canada)
• State/Province: State or Province Name such as BC (British Columbia)
• City: City Name
• Organization: Organization Name
• Organization Unit: Organizational Unit, similar to Directories in a Directory Service
• Email: Email address for IT Contact
• SANS: Other accepted names, should include CN if CN is to be accepted

Here, most important part is SAN format and details. SAN Syntax

• Email: email:[email protected]
• IP Address: IP:1.1.1.1
• DNS Name: DNS:www.companyname.com

Note – Multiple SANs should be separated by comma (,) and without a space such as DNS:www.companyname.com,DNS:www.companyname1.com,DNS:www.companyname2.com

If you want to access GUI securely with both IP and FQDN, you should add both in SAN with appropriate syntax.

Let’s consider creating CSR with name ” FGT-Cert” Management IP 192.168.1.1 and FQDN fortinet.ictkb.local

#execute vpn certificate local generate rsa FGT-Cert 2048 *.ictkb.local CA BC BC ICTKB IT [email protected] IP:192.168.1.1,DNS:fortinet.ictkb.local

Here,

• Encryption: rsa,
• Certificate name: FGT-Cert,
• Key size: 2048,
• Host IP/Domain name (Common name): *.ictkb.local Here we have given wildcard mask, you can give device IP or just domain,
• Country: CA,
• State: BC,
• City: BC,
• Organization: ICTKB,
• department: IT,
• Email: [email protected]
• SAN: IP:192.168.1.1,DNS:fortinet.ictkb.local We have given 2 value in SAN field, IP and fqdn since we would like to access securely from both IP and fqdn. While giving multiple values, use command but not space. Ex IP:xxxx,DNS:xxx.xx.

Next, once you hit enter you will see “Global certificate Signing state pending” just below command you entered.

At this moment, if you go to GUI and check certificate status, it will be “unknown”. Then, copy certificate and send for signing.

Command syntax to open certificate: #show full vpn certificate [store] [certificate_name]

In our case we will run #show full vpn certificate local FGT-Cert

Find the set csr section and copy the contents i-between the quotation marks (i.e. Everything in-between and including —–BEGIN CERTIFICATE REQUEST—– to —–END CERTIFICATE REQUEST—-).

At last, once you get signed CSR, run below to set signed value:

We will run,

#config vpn certificate local

#set certificate "------BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST---- "

#end

Once completed, you can go back to System >> Certificate, newly generated certificate “FGT-Cert” will be valid and showing expiry date under local certificate..

Note: Root certificate mut be present in Firewall for above procedure else newly generated certificate will not be valid. Get Root certificate and upload it. It will display as Remote certificate.

Now, you can navigate to System >> Setting>> HTTP Server Certificate >>Select new certificate>> Apply.

Hurray! You are now secured with CSR certificate