To configure FortiOS:
- Go to System > Certificates. If Certificates is unavailable, enable the feature in System > Feature Visibility > Certificates.
- Import the CA certificate:
- Select Import > CA Certificate.
- For Type, select File.
- Use the Upload button to locate the CA certificate that you generated in Creating certificates in FortiAuthenticator.
- Click OK. The uploaded certificate appears under Remote CA Certificate with the name CA_Cert_1. You can identify the certificate by the Subject column. In this example, the Subject column displays CN=lab.
- Import the server certificate:
- Select Import > Local Certificate.
- For Type, select PKCS #12 Certificate.
- Use the Upload button to locate the server certificate that you generated in Creating certificates in FortiAuthenticator.
- Enter the password that you defined when exporting the certificate-key pair. Click OK.
To use certificate authentication, you must create PKI users in the CLI. Enter the following commands:
config user peer
set ca CA_Cert_1
set subject jhalpert
- Configure VPN settings:
- Go to VPN > SSL-VPN Settings.
- Locate Server Certificate and find the server certificate that you uploaded.
- Enable Require Client Certificate.
- Click Apply.