Authenticating administrators with security certificates

Authenticating administrators with security certificates

You can install a certificate on the management computer to support strong authentication for administrators. When a personal certificate is installed on the management computer, the FortiGate unit processes the certificate after the administrator supplies a username and password.

To enable strong administrative authentication:

  • Obtain a signed personal certificate for the administrator from a CA and load the signed personal certificate into the web browser on the management computer according to the browser documentation.
  • Install the root certificate and the CRL from the issuing CA on the FortiGate unit (see Installing a CA root certificate and CRL to authenticate remote clients on page 118 ).
  • Create a PKI user account for the administrator. l Add the PKI user account to a firewall user group dedicated to PKI-authenticated administrators.

Configuring certificate-based authentication

  • In the administrator account configuration, select PKI as the account Type and select the User Group to which the administrator belongs.

Support exact match for subject and CN fields in peer user

In order to avoid any unintentional admin access by regular users, administrators can specify which way a peer user authenticates.

When searching for a matching certificate, use the commands below to control how to find matches in the certificate subject name (subject-match) or the cn attribute (cn-match) of the certificate subject name. This match can be any string (substring) or an exact match (value) of the cn attribute value.

To determine certificate subject name matches – CLI:

config vpn certificate setting edit <name> set subject-match {substring | value} set cn-match {substring | value}



Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos