execute certificate

Use this command to export and import certificates.

execute certificate ca export tftp <local_certificate_name> <file_name> <IP_address_TFTP_server>   Export the CA certificate to a TFTP server.
			
execute certificate ca import auto <CA_server_URL> <optional_CA_identifier> <optional_source_IP_address>   Import the CA certificate using SCEP.
			
execute certificate ca import tftp <file_name> <IP_address_TFTP_server>   Import the CA certificate from a TFTP server.

execute certificate crl import auto <CRL_name>   Import the certificate revocation list (CRL).

execute certificate local export tftp <certificate_name> {'cer' | 'p12' | 'csr'} <file_name> <IP_address_TFTP_server>   Export the local certificate or certificate request to a TFTP server.
			
execute certificate local generate {default-ssl-ca | default-ssl-ca-untrusted | default-ssl-key-certs | default-ssl-serv-key}   Generate the default CA certificate, key certificates, or server key.
			
execute certifcate local generate ec <certificate_name> {secp256rl | secp384rl | secp521rl} <email_subject> <country_name_or_code> <state> <city> <organization> <delimiter> <email_address> <optional_alternate_name> <optional_URL> <optional_password> <optional_source_IP_address> <optional_CA_identifier> <optional_private_key_password>   Generate an elliptic curve certificate request.

execute certificate local generate rsa <certificate_name> {1024 | 1536 | 2048 | 4096} <email_subject> <country_name_or_code> <state> <city> <organization> <delimiter> <email_address> <optional_alternate_name> <optional_URL> <optional_password> <optional_source_IP_address> <optional_CA_identifier> <optional_private_key_password>   Generate an RSA certificate request.

execute certificate local import tftp <file_name> <IP_address_TFTP_server> {'cer' | 'p12'} <optional_password>   Import the signed certificate from a TFTP server.
			
execute certificate local verify <local_certificate_name>   Verify that the certificate and private key files match and regenerate them if they do not match.
			
execute certificate remote export tftp <remote_certificate_name> <file_name_on_TFTP_server> <IP_address_TFTP_server>
			
execute certificate remote import tftp <file_name_on_TFTP_server> <IP_address_TFTP_server>

• Use set-mgmt-id to change or initially set the management ID or your account number for Central Management Services. This account ID must be set for the service to be enabled.
• Use register-device to register the FortiProxy unit with a specific FortiManager unit specified by serial number. You must also specify the administrator name and password that the FortiManager unit uses to log on to the FortiProxy unit.
• Use unregister-device to remove the FortiProxy unit from the specified FortiManager unitʼs device list.
• Use update to update your Central Management Service contract with your new management account ID. Use this command if there are any changes to your management service account.

Examples

To import a CRL named mycrl:

execute certificate crl import auto mycrl

To generate the default CA certificate used by SSL inspection:

execute certificate local generate default-ssl-ca

To verify the local certificate named mycert matches the private key files:

execute certificate local verify mycert