6.5.12 Fortinet FortiGate

Configure the FortiOS API token, certificate scope, VDOM, and target service

CertKit provides FortiGate templates for the Admin UI, SSL-VPN, IPsec VPN, and shared user authentication services.

Templates

Template Binding updated
Fortinet FortiGate: Admin UI Administrative HTTPS admin-server-cert.
Fortinet FortiGate: SSL-VPN SSL-VPN server certificate.
Fortinet FortiGate: IPsec VPN Certificate on an existing phase1-interface.
Fortinet FortiGate: User Authentication Services Shared certificate used by user portals, WiFi captive portals, and FortiClient IKEv2 IPsec SAML authentication.

Each template uploads the certificate, private key, and intermediate chain through the FortiOS REST API. CertKit uses deterministic certkit_* names and removes its superseded certificates after updating the binding.

REST API administrator

In FortiGate, open System > Administrators > New REST API Admin. Create a token for an account with read/write access to:

  • VPN
  • System > Configuration

Enter the token in FortiOS REST API token. The agent host must reach the FortiGate management interface over HTTPS.

Global and VDOM scope

Set Certificate scope to:

  • global for a certificate stored at appliance scope. This is the default.
  • vdom for a certificate stored in one virtual domain.

When using vdom, set VDOM name to the exact target VDOM. Leave it as none for a global deployment. The scope, VDOM, and target service must refer to the same configuration context.

IPsec requirement

The IPsec template requires an existing tunnel configured for certificate or signature authentication. Enter the exact phase1-interface name. The template does not convert a preshared-key tunnel to certificate authentication.

Common problems

  • Unauthorized or forbidden API response: verify both required permission groups on the REST API administrator.
  • Target not found: confirm the VDOM, certificate scope, and tunnel name.
  • Certificate imports but the wrong service changes: select the template for the intended FortiGate binding; the four templates update different configuration objects.
  • IPsec binding fails: confirm the existing tunnel is configured for certificate authentication.

For a product overview, see certificate automation for Fortinet FortiGate.