config certificate local
Local keys and certificates.
config certificate local
Description: Local keys and certificates.
edit <name>
set acme-ca-url {string}
set acme-domain {string}
set acme-email {string}
set acme-renew-window {integer}
set acme-rsa-key-size {integer}
set auto-regenerate-days {integer}
set auto-regenerate-days-warning {integer}
set ca-identifier {string}
set certificate {user}
set cmp-path {string}
set cmp-regeneration-method [keyupate|renewal]
set cmp-server {string}
set cmp-server-cert {string}
set comments {string}
set csr {user}
set enroll-protocol [none|scep|...]
set ike-localid {string}
set ike-localid-type [asn1dn|fqdn]
set name-encoding [printable|utf8]
set password {password}
set private-key {user}
set private-key-retain [enable|disable]
set range [global|vdom]
set scep-password {password}
set scep-url {string}
set source [factory|user|...]
set source-ip {ipv4-address}
set state {user}
next
end
config certificate local
|
Parameter |
Description |
Type |
Size |
Default |
||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
acme-ca-url |
The URL for the ACME CA server. |
string |
Maximum length: 255 |
https://acme-v02.api.letsencrypt.org/directory |
||||||||||
|
acme-domain |
A valid domain that resolves to this FortiGate unit. |
string |
Maximum length: 255 |
|
||||||||||
|
acme-email |
Contact email address that is required by some CAs like LetsEncrypt. |
string |
Maximum length: 255 |
|
||||||||||
|
acme-renew-window |
Beginning of the renewal window. |
integer |
Minimum value: 1 Maximum value: 100 |
30 |
||||||||||
|
acme-rsa-key-size |
Length of the RSA private key of the generated cert (Minimum 2048 bits). |
integer |
Minimum value: 2048 Maximum value: 4096 |
2048 |
||||||||||
|
auto-regenerate-days |
Number of days to wait before expiry of an updated local certificate is requested (0 = disabled). |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||||||
|
auto-regenerate-days-warning |
Number of days to wait before an expiry warning message is generated (0 = disabled). |
integer |
Minimum value: 0 Maximum value: 4294967295 |
0 |
||||||||||
|
ca-identifier |
CA identifier of the CA server for signing via SCEP. |
string |
Maximum length: 255 |
|
||||||||||
|
certificate |
PEM format certificate. |
user |
Not Specified |
|
||||||||||
|
cmp-path |
Path location inside CMP server. |
string |
Maximum length: 255 |
|
||||||||||
|
cmp-regeneration-method |
CMP auto-regeneration method. |
option |
- |
keyupate |
||||||||||
|
|
|
|||||||||||||
|
cmp-server |
Address and port for CMP server (format = address:port). |
string |
Maximum length: 63 |
|
||||||||||
|
cmp-server-cert |
CMP server certificate. |
string |
Maximum length: 79 |
|
||||||||||
|
comments |
Comment. |
string |
Maximum length: 511 |
|
||||||||||
|
csr |
Certificate Signing Request. |
user |
Not Specified |
|
||||||||||
|
enroll-protocol |
Certificate enrollment protocol. |
option |
- |
none |
||||||||||
|
|
|
|||||||||||||
|
ike-localid |
Local ID the FortiGate uses for authentication as a VPN client. |
string |
Maximum length: 63 |
|
||||||||||
|
ike-localid-type |
IKE local ID type. |
option |
- |
asn1dn |
||||||||||
|
|
|
|||||||||||||
|
name |
Name. |
string |
Maximum length: 35 |
|
||||||||||
|
name-encoding |
Name encoding method for auto-regeneration. |
option |
- |
printable |
||||||||||
|
|
|
|||||||||||||
|
password |
Password as a PEM file. |
password |
Not Specified |
|
||||||||||
|
private-key |
PEM format key encrypted with a password. |
user |
Not Specified |
|
||||||||||
|
private-key-retain |
Enable/disable retention of private key during SCEP renewal. |
option |
- |
disable |
||||||||||
|
|
|
|||||||||||||
|
range |
Either a global or VDOM IP address range for the certificate. |
option |
- |
global |
||||||||||
|
|
|
|||||||||||||
|
scep-password |
SCEP server challenge password for auto-regeneration. |
password |
Not Specified |
|
||||||||||
|
scep-url |
SCEP server URL. |
string |
Maximum length: 255 |
|
||||||||||
|
source |
Certificate source type. |
option |
- |
user |
||||||||||
|
|
|
|||||||||||||
|
source-ip |
Source IP address for communications to the SCEP server. |
ipv4-address |
Not Specified |
0.0.0.0 |
||||||||||
|
state |
Certificate Signing Request State. |
user |
Not Specified |
|
||||||||||