Generate a CSR for a FortiManager-Managed FortiGate

A CSR for a FortiGate certificate should be generated on the FortiGate, even when it is managed by FortiManager. This ensures the corresponding private key remains securely stored on that FortiGate.

Recommended method: FortiGate GUI through FortiManager

1. In FortiManager, go to: Device Manager → Device & Groups → select the FortiGate.
2. Open the FortiGate’s GUI using the device’s HTTPS/GUI connection option. Alternatively, connect directly to the FortiGate management IP.
3. On the FortiGate, navigate to: System → Certificates.
4. Select: Create/Import → Generate CSR.
5. Configure:
   • Certificate name: for example, FGT_HTTPS_Cert
   • Subject/ID type: Domain Name, IP address, or Email
   • Common Name: the FQDN clients use, such as firewall.example.com
   • Organization, OU, country, state, as required
   • Subject Alternative Names: add all DNS names or IP addresses that will access the FortiGate
   • Key type/size: RSA 2048 or 3072 is normally appropriate
   • Enrollment method: File-based
6. Generate and download the CSR.
7. Submit the CSR to your internal CA or public certificate authority.

The FortiGate will show the certificate as Pending. Do not delete that pending entry because it contains the private key association.

Import the signed certificate

Once the CA returns the signed certificate:

1. Return to: System → Certificates.
2. Select: Create/Import → Import Certificate → Local Certificate.
3. Upload the signed certificate.

FortiGate should associate it with the pending CSR automatically. If the issuing CA is not already trusted, also import the root and intermediate CA certificates under:

Create/Import → Import Certificate → CA Certificate

Assign the certificate

For administrative HTTPS access:

config system global
    set admin-server-cert "FGT_HTTPS_Cert"
end

For SSL VPN:

config vpn ssl settings
    set servercert "FGT_HTTPS_Cert"
end

These changes can also be configured through the appropriate FortiManager device settings or CLI template/script.

Important FortiManager consideration

Generating or importing the certificate directly on the FortiGate is normal because the private key is device-specific. Afterward, check the FortiManager device status. If it reports an out-of-sync configuration, use:

Device Manager → select the FortiGate → Revision History/Retrieve Config

Avoid regenerating or deleting the pending CSR before importing the signed certificate; a certificate signed from the original CSR will not match a newly generated private key.

No matching internal KB article was found for this procedure. Fortinet documentation can be located through the official Fortinet Documentation Library.