FortiGate SSL Certificate Installation and Automation

FortiGate appliances terminate or inspect TLS for VPNs, admin GUIs, and deep inspection profiles. Unlike a simple Nginx vhost, putting an SSL certificate on FortiGate means PKCS#12 imports, CN/SAN that match how users connect, and renewals that cannot rely on a random Certbot cron on the firewall itself. This guide covers manual install and how agentless automation fits.

FortiGate SSL certificate installation

Where FortiGate Uses Certificates

Common use cases:

HTTPS admin access to the GUI
SSL VPN portal and tunnel
Deep inspection / SSL inspection CA (different from public server certs)
Server certificates for virtual IPs / load-balanced HTTPS

Deep inspection CAs are usually internal; this article focuses on publicly trusted server certificates you buy or issue for hostnames clients already trust.

Manual Install Overview

Typical GUI path (labels vary by FortiOS version):

Generate or upload a CSR / certificate
Complete CA validation (email, DNS, or HTTP — HTTP on the FortiGate itself is often awkward)
Import the signed certificate and CA chain — FortiGate frequently expects a PKCS#12 (.pfx) bundle
Assign the certificate to the SSL VPN / VIP / admin settings
Verify from an external client, not only from inside the firewall

Format primer: PEM vs PFX. Buying steps: how to buy an SSL certificate.

Why FortiGate Renewals Hurt

Public certificate lifetimes keep dropping (validity periods explained). Firewalls are:

Rarely included in web-server ACME tooling
Change-controlled (every import may need a change ticket)
Easy to forget until VPN users scream

Teams either calendar-remind every 60–90 days or connect the FortiGate to an orchestrator that can push a new PFX when the CA issues.

Agentless Automation with Certinite

Certinite treats FortiGate as an agentless deployment target: API credentials stay encrypted in the tenant, CSR/key material can be generated server-side, and when a commercial or automated order completes, the connector imports the certificate. Approver email for email-DCV can be stored on the connector.

That model avoids installing a polling agent on the appliance OS. Learn more on the product site and register to attach a FortiGate target in the setup wizard.

Validation Tips for Appliances

Prefer DNS or email DCV when the FortiGate cannot easily serve HTTP-01 tokens on the public hostname
Ensure the certificate SAN matches the VPN hostname users type (vpn.company.com)
Import the full chain; missing intermediates cause mobile VPN failures
Keep the previous certificate assigned until the new one is verified
Document which VIP/portal uses which cert thumbprint

Security Notes

Use least-privilege API users for automation
Rotate API tokens when staff leave
Do not reuse deep-inspection private keys as public server keys
Store PFX passwords in a vault, not in ticket comments

FAQ

Can Let's Encrypt run directly on FortiGate?

Not as a first-class built-in ACME client the way Certbot does on Linux. People terminate ACME elsewhere and import, or use an external orchestrator.

Should VPN and public website share one wildcard?

Possible with *.company.com, but blast radius grows when the key is on both CDN and firewall. Many orgs split certificates by role.

Commercial vs free for FortiGate?

Either works if the chain is publicly trusted. Commercial DV with longer validity reduces change windows; free LE increases renewal frequency. See free vs paid SSL.

What about SSL inspection certificates?

Those are usually private CAs pushed to managed devices — a different workflow from buying a public DV certificate.

Next Steps

Inventory every FortiGate hostname that presents a public cert
Standardize on PFX import + chain verification
Automate renewals before the next CA/B deadline wave