Chapter: execute > certificate

certificate

Use these commands to manage certificates.

certificate ca

Use these commands to list CA certificates, and to import or export CA certificates.

Syntax

To list the CA certificates installed on the FortiManager unit:

execute certificate ca list

To export or import CA certificates:

execute certificate ca {<export>|<import>} <cert_name> <tftp_ip>

Variable

Description

list

Generate a list of CA certificates on the FortiManager system.

<export>

Export CA certificate to TFTP server.

<import>

Import CA certificate from a TFTP server.

<cert_name>

Name of the certificate.

<tftp_ip>

IP address of the TFTP server.

certificate local

Use these commands to list local certificates, and to import or export local certificates. To generate a certificate request, see “certificate local generate” on page 170.

Syntax

To list the local certificates installed on the FortiManager unit:

execute certificate local list

To export or import local certificates:

execute certificate local {<export>|<import>} <cert_name> <tftp_ip>

Variable

Description

list

Generate a list of CA certificates on the FortiManager system.

<export>

Export CA certificate to TFTP server.

<import>

Import CA certificate from a TFTP server.

<cert_name>

Name of the certificate.

<tftp_ip>

IP address of the TFTP server.

certificate local generate

Use this command to generate a certificate request.

Syntax

execute certificate local generate <certificate-name_str> <subject> <number> [<optional_information>]

Variable

Description

<certificate-name_str>

Enter a name for the certificate. The name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), and the special characters - and _. Other special characters and spaces are not allowed.

<number>

Enter 512, 1024, 1536, or 2048 for the size, in bits, of the encryption key.

<subject>

Enter one of the following pieces of information to identify the FortiManager unit being certified:

  • The FortiManager unit IP address
  • The fully qualified domain name of the FortiManager unit
  • An email address that identifies the FortiManager unit
  • An IP address or domain name is preferable to an email address.

[<optional_information>]

Enter optional_information as required to further identify the unit.

See the below table for the list of optional information variables. You must enter the optional variables in the order that they are listed in the table.

To enter any optional variable you must enter all of the variables that come before it in the list.

For example, to enter the organization_name_str, you must first enter the country_code_str, state_name_str, and city_name_str.

While entering optional variables, you can type? for help on the next required variable.

Optional information variables

Variable

Description

<country_code_str>

Enter the two-character country code.

<state_name_str>

Enter the name of the state or province where the FortiManager unit is located.

<city_name_str>

Enter the name of the city, or town, where the person or organization certifying the FortiManager unit resides.

<organization-name_str>

Enter the name of the organization that is requesting the certificate for the FortiManager unit.

<organization-unit_name_str>

Enter a name that identifies the department or unit within the organization that is requesting the certificate for the FortiManager unit.

<email_address_str>

Enter a contact email address for the FortiManager unit.

<ca_server_url>

Enter the URL of the CA (SCEP) certificate server that allows auto-signing of the request.

<challenge_password>

Enter the challenge password for the SCEP certificate server.