Local CA Certificate Not Available in FortiManager SSL Inspection Profile

Yes—your finding confirms this is a FortiManager object-scope issue, not a certificate validity or private-key issue.

Why this happens

The SSH/SSL inspection profile is an ADOM/policy-package object, while the certificate generated from the FortiGate CSR is a device-specific local certificate.

FortiManager therefore does not expose that device-local certificate directly in the common certificate dropdown. Instead, it expects an abstract certificate object with a per-device mapping to the actual certificate installed on each FortiGate.

The fact that the certificate is selectable inside the per-device mapping confirms that:

• The signed certificate is correctly associated with the FortiGate-generated private key.
• FortiGate considers it a valid local certificate.
• FortiManager has successfully retrieved it into the device database.
• The remaining requirement is simply the FortiManager per-device mapping.

Generating the CSR directly on the FortiGate is also the correct approach because the private key remains on that FortiGate KB: Generate a CSR for a FortiManager-Managed FortiGate.

Correct FortiManager configuration

In the SSH/SSL inspection profile:

1. Open the CA certificate selection.

2. Select Create New.

3. Give the FortiManager certificate object a descriptive name, for example:

   Copy CLI

   SSL_Inspection_CA_Mapping
   

4. Enable/configure Per-Device Mapping.

5. Select the relevant FortiGate.

6. Map it to the actual local certificate on that FortiGate.

7. Save the certificate mapping.

8. Select the new mapped object in the SSH/SSL inspection profile.

9. Install the policy package.

If the policy package targets several FortiGates, create a mapping for each device:

Each FortiGate can retain its own private key and subordinate CA certificate while the policy package references one logical FortiManager object.

Verify before installation

Use Install Preview and confirm the resolved FortiGate configuration contains the expected certificate:

config firewall ssl-ssh-profile
    edit "<profile-name>"
        set caname "<actual-local-certificate-name>"
    next
end

After installation, verify on the FortiGate:

show full-configuration firewall ssl-ssh-profile "<profile-name>"

Therefore, the per-device certificate mapping you found is the intended FortiManager solution. Certificate templates are not required for this particular workflow.