Fortinet FortiGate 4000 - Manual (Page 246)

246
Fortinet Inc.
Managing digital certificates IPSec VPN
Managing digital certificates
Use digital certificates to make sure that both participants in an IPSec communication
session are trustworthy, prior to setting up an encrypted VPN tunnel between the
participants.
Fortinet uses a manual procedure to obtain certificates. This involves copying and
pasting text files from your local computer to the certificate authority, and from the
certificate authority to your local computer.
• Obtaining a signed local certificate
• Obtaining CA certificates
Obtaining a signed local certificate
The signed local certificate provides the FortiGate unit with a means to authenticate
itself to other devices.
Generating the certificate request
With this procedure, you generate a private and public key pair. The public key is the
base component of the certificate request.
To generate the certificate request
1 Go to VPN > Certificates > Local Certificates.
2 Select Generate.
3 Type a Certificate Name.
The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and
the special characters - and _. Other special characters and spaces are not allowed.
4 Configure the Subject Information that identifies the object being certified.
Preferably use an IP address or domain name. If this is impossible (such as with a
dialup client), use an email address.
5 Configure the Optional Information to further identify the object being certified.
Note: Digital certificates are not required for configuring FortiGate VPNs. Digital certificates are
an advanced feature provided for the convenience of system administrators. This manual
assumes the user has prior knowledge of how to configure digital certificates for their
implementation.
Note: The VPN peers must use digital certificates that adhere to the X.509 standard.
Host IP For Host IP, enter the IP address of the FortiGate unit being certified.
Domain Name For Domain name, enter the fully qualified domain name of the FortiGate
unit being certified. Do not include the protocol specification (http://) or
any port number or path names.
E-Mail For E-mail, enter the email address of the owner of the FortiGate unit
being certified. Typically, e-mail addresses are entered only for clients, not
gateways.