Fortinet FortiGate Series Administration Guide

System Certificates
FortiGate Version 4.0 MR1 Administration Guide
01-410-89802-20090903 301
http://docs.fortinet.com/ • Feedback
System Certificates
This section explains how to manage X.509 security certificates using the FortiGate web-
based manager. Certificate authentication allows administrators to generate certificate
requests, install signed certificates, import CA root certificates and certificate revocation
lists, and back up and restore installed certificates and private keys.
Authentication is the process of determining if a remote host can be trusted with access to
network resources. To establish its trustworthiness, the remote host must provide an
acceptable authentication certificate by obtaining a certificate from a certification authority
(CA). The FortiGate unit can then use certificate authentication to reject or allow
administrative access via HTTPS, and to authenticate IPSec VPN peers or clients, as well
as SSL VPN user groups or clients.
If you enable virtual domains (VDOMs) on the FortiGate unit, system certificates are
configured globally for the entire FortiGate unit. For details, see “Using virtual domains” on
page 159.
There are several certificates on the FortiGate unit that have been automatically
generated.
System administrators can use these certificates wherever they may be required, for
example, with SSL VPN, IPSec, LDAP, and PKI.
For additional background information on certificates, see the FortiGate Certificate
Management User Guide.
Table 42: Automatically generated FortiGate certificates
Fortinet_Firmware Embedded inside the firmware. Signed by Fortinet_CA. Same on all
FortiGate units. Used so FortiGate units without Fortinet_Factory2
certificates have a built-in certificate signed by a FortiGate CA.
Listed under Certificates > Local, or in FortiGate CLI under vpn
certificate local.
Fortinet_Factory Embedded inside BIOS. Signed by Fortinet_CA. Unique to each FortiGate
unit. Used for FortiGate/FortiManager tunnel, HTTPS administrative
access if Fortinet_Factory2 is not available.
Listed under Certificates > Local, or in FortiGate CLI under vpn
certificate local.
Fortinet_Factory2 Embedded inside BIOS. Signed by Fortinet_CA2. Unique to each
FortiGate unit. Used for FortiGate/FortiManager tunnel and HTTPS
administrative access.
Listed under Certificates > Local, or in FortiGate CLI under vpn
certificate local. Found only on units shipped at the end of 2008
onward.
Fortinet_CA Embedded inside firmware and BIOS. Fortinet’s CA certificate. Used to
verify certificates that claim to be signed by Fortinet, for example with a
FortiGate/FortiManager tunnel or an SSL connection to a FortiGuard
server.
Listed under Certificates > CA, or in FortiGate CLI under vpn
certificate ca or vpn certificate ocsp.
Fortinet_CA2 Embedded inside BIOS. Fortinet’s CA certificate. Will eventually replace
Fortinet_CA, as Fortinet_CA will expire in 2020.
Listed under Certificates > CA, or in FortiGate CLI under vpn
certificate ca or vpn certificate ocsp. Found only on units
shipped at the end of 2008 onward.

Fortinet FortiGate Series Specifications

General

Model	FortiGate Series
Category	Firewall
Throughput	Varies by model
Interfaces	Varies by model
Concurrent Sessions	Varies by model
VPN Support	Yes
High Availability	Yes
Firewall Throughput	Varies by model
VPN Throughput	Varies by model
IPS Throughput	Varies by model
NGFW Throughput	Varies by model
Threat Protection Throughput	Varies by model
New Sessions per Second	Varies by model
Power Supply	Varies by model
Security Features	Firewall, IPS, Application Control, Web Filtering, Antivirus, VPN
Virtual Domains	Yes
Form Factor	Desktop, Rackmount