When a FortiGate is managed via FortiManager, administering the FortiGate outside of FortiManager can cause the configuration to become out of sync. While updating an SSL certificate used for VPN access on a FortiGate for a customer, I found that I was unable to create a certificate signing request from FortiManager. After doing some research, I found a Fortinet cookbook article that explains that the certificate must be requested and the certificate request completed from the FortiGate itself, even if the device is managed via FortiManager. To complete this process, do the following:
- Login to the FortiGate in read-write mode
- Create a certificate signing request on the FortiGate
- Download the certificate signing request from the FortiGate
- Submit the certificate signing request to the certificate authority
- Download the issued certificate from the certificate authority
- Import the certificate on the FortiGate to complete the certificate signing request
- Login to FortiManager
- Select the FortiGate in Device Manager and go to the "System: Dashboard" page
- In the "Configuration and Installation Status" pane, click the "Revision History" (four horizontal lines) icon on the "Total Revisions" line
- Click the "Retrieve Config" button
- The current configuration, including the new certificate, will be retrieved.
- The certificate should now be able to be used in configurations managed in FortiManager
If you are deleting the old certificate, you will need to write the config to the FortiGate from FortiManager so that it is no longer using the old certificate. After the old certificate is no longer in use, you can login to the FortiGate in read-write mode and delete the old certificate. After the old certificate is deleted, you will need to repeat the "Retrieve Config" operation.
The Fortinet cookbook article explaining this process can be found at https://kb.fortinet.com/kb/documentLink.do?externalID=FD35142