Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    6.4.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.0.0
    5.6.0
    5.4.0
    5.2.0
    5.0.0

    certificate local

    Local keys and certificates.

      config certificate local
      Description: Local keys and certificates.
      edit <name>
          set password {password}
          set comments {string}
          set private-key {user}
          set certificate {user}
          set csr {user}
          set state {user}
          set scep-url {string}
          set range [global|vdom]
          set source [factory|user|...]
          set auto-regenerate-days {integer}
          set auto-regenerate-days-warning {integer}
          set scep-password {password}
          set ca-identifier {string}
          set name-encoding [printable|utf8]
          set source-ip {ipv4-address}
          set ike-localid {string}
          set ike-localid-type [asn1dn|fqdn]
          set enroll-protocol [none|scep|...]
          set cmp-server {string}
          set cmp-path {string}
          set cmp-server-cert {string}
          set cmp-regeneration-method [keyupate|renewal]
      next
  end

    config certificate local

    Parameter Name Description Type Size
    password Password as a PEM file. password Not Specified
    comments Comment. string Maximum length: 511
    private-key PEM format key, encrypted with a password. user Not Specified
    certificate PEM format certificate. user Not Specified
    csr Certificate Signing Request. user Not Specified
    state Certificate Signing Request State. user Not Specified
    scep-url SCEP server URL. string Maximum length: 255
    range Either a global or VDOM IP address range for the certificate.
    global: Global range.
    vdom: VDOM IP address range.
    		 option -
    source Certificate source type.
    factory: Factory installed certificate.
    user: User generated certificate.
    bundle: Bundle file certificate.
    		 option -
    auto-regenerate-days Number of days to wait before expiry of an updated local certificate is requested (0 = disabled). integer Minimum value: 0 Maximum value: 4294967295
    auto-regenerate-days-warning Number of days to wait before an expiry warning message is generated (0 = disabled). integer Minimum value: 0 Maximum value: 4294967295
    scep-password SCEP server challenge password for auto-regeneration. password Not Specified
    ca-identifier CA identifier of the CA server for signing via SCEP. string Maximum length: 255
    name-encoding Name encoding method for auto-regeneration.
    printable: Printable encoding (default).
    utf8: UTF-8 encoding.
    		 option -
    source-ip Source IP address for communications to the SCEP server. ipv4-address Not Specified
    ike-localid Local ID the FortiGate uses for authentication as a VPN client. string Maximum length: 63
    ike-localid-type IKE local ID type.
    asn1dn: ASN.1 distinguished name.
    fqdn: Fully qualified domain name.
    		 option -
    enroll-protocol Certificate enrollment protocol.
    none: None (default).
    scep: Simple Certificate Enrollment Protocol.
    cmpv2: Certificate Management Protocol Version 2.
    		 option -
    cmp-server 'ADDRESS:PORT' for CMP server. string Maximum length: 63
    cmp-path Path location inside CMP server. string Maximum length: 255
    cmp-server-cert CMP server certificate. string Maximum length: 79
    cmp-regeneration-method CMP auto-regeneration method.
    keyupate: Key Update.
    renewal: Renewal.
    		 option -
    Previous
    Next

    certificate local

    Local keys and certificates.

      config certificate local
      Description: Local keys and certificates.
      edit <name>
          set password {password}
          set comments {string}
          set private-key {user}
          set certificate {user}
          set csr {user}
          set state {user}
          set scep-url {string}
          set range [global|vdom]
          set source [factory|user|...]
          set auto-regenerate-days {integer}
          set auto-regenerate-days-warning {integer}
          set scep-password {password}
          set ca-identifier {string}
          set name-encoding [printable|utf8]
          set source-ip {ipv4-address}
          set ike-localid {string}
          set ike-localid-type [asn1dn|fqdn]
          set enroll-protocol [none|scep|...]
          set cmp-server {string}
          set cmp-path {string}
          set cmp-server-cert {string}
          set cmp-regeneration-method [keyupate|renewal]
      next
  end

    config certificate local

    Parameter Name Description Type Size
    password Password as a PEM file. password Not Specified
    comments Comment. string Maximum length: 511
    private-key PEM format key, encrypted with a password. user Not Specified
    certificate PEM format certificate. user Not Specified
    csr Certificate Signing Request. user Not Specified
    state Certificate Signing Request State. user Not Specified
    scep-url SCEP server URL. string Maximum length: 255
    range Either a global or VDOM IP address range for the certificate.
    global: Global range.
    vdom: VDOM IP address range.
    		 option -
    source Certificate source type.
    factory: Factory installed certificate.
    user: User generated certificate.
    bundle: Bundle file certificate.
    		 option -
    auto-regenerate-days Number of days to wait before expiry of an updated local certificate is requested (0 = disabled). integer Minimum value: 0 Maximum value: 4294967295
    auto-regenerate-days-warning Number of days to wait before an expiry warning message is generated (0 = disabled). integer Minimum value: 0 Maximum value: 4294967295
    scep-password SCEP server challenge password for auto-regeneration. password Not Specified
    ca-identifier CA identifier of the CA server for signing via SCEP. string Maximum length: 255
    name-encoding Name encoding method for auto-regeneration.
    printable: Printable encoding (default).
    utf8: UTF-8 encoding.
    		 option -
    source-ip Source IP address for communications to the SCEP server. ipv4-address Not Specified
    ike-localid Local ID the FortiGate uses for authentication as a VPN client. string Maximum length: 63
    ike-localid-type IKE local ID type.
    asn1dn: ASN.1 distinguished name.
    fqdn: Fully qualified domain name.
    		 option -
    enroll-protocol Certificate enrollment protocol.
    none: None (default).
    scep: Simple Certificate Enrollment Protocol.
    cmpv2: Certificate Management Protocol Version 2.
    		 option -
    cmp-server 'ADDRESS:PORT' for CMP server. string Maximum length: 63
    cmp-path Path location inside CMP server. string Maximum length: 255
    cmp-server-cert CMP server certificate. string Maximum length: 79
    cmp-regeneration-method CMP auto-regeneration method.
    keyupate: Key Update.
    renewal: Renewal.
    		 option -
    Previous
    Next