Generate User IPsec x509 certificate

[Tonatiuh]

I have generate the cacert and private key, and uploaded to fotiWiFi 60E. I did this using OpenSSL following the instructions in FortiOS 5.6 - Authentication manual (page 122).

Now, how do I generate the user certificate for IPsec tunel ? This, the certificate that every user connecting to the IPsec tunel must have installed in its computer to be able to connect.

Regards,

[EMES]

You would have to generate them using OpenSSL like you did with the CA Cert, The Fortigate has no mechanism to generate certificates, only Certificate Signing Requests. Use the CA to sign the user cert in OpenSSL. You can also do this automatically using automatic certificate enrollment if you are using active directory and a Certificate authority server.

[Tonatiuh]

Thank you EMES. I already new that theory.

Would you have the command syntax for that purpose?

Best regards,

[emnoc]

Easy

The  USER cert  signing needs the  USER.csr CA-key and CA-cert

(here's my own CA signing  a usercert  that has a CN=<usernamebahblab> )

openssl x509 -req -sha256 -days 366  -CA SOCPUPPETSCAroot.cert -CAkey    SOCPUPPETSCArsa.key -CAcreateserial   -in usernameblah.csr -out usernamblah.crt

[Tonatiuh]

Any command to generate the USER.csr?

Regards,

[emnoc]

If your talking windows and a end-user here's what I reccommend

http://socpuppet.blogspot.com/2017/05/how-to-use-certreq-tool-to-build-csr-on.html

This is support under most windows systems natively.

Ken