"<certificate_name>"

domain "<application_domain_name>"

Enter the domain name of your application. FortiWeb will then retrieve the CA certificate for this domain from Let's encrypt.
For Let's encrypt certificate, it's supported to added add up to 11 domains. One of them should be root domain, while the rest 10 should all belong to the root domain.
It's recommended to enter the root domain here, then add the rest domain items in san-dns <domain_name>.

renewal-period <int>

Set how soon FortiWeb obtains the TLS certificate from Let’s Encrypt. The valid range is 1-60 days.

validation-method {HTTP-01 | TLS-ALPN-01 | DNS-01}

• HTTP-01: Let's Encrypt will send HTTP request to FortiWeb for validation.
  When in RP mode, you must select HTTP service and uses port 80 for it in the server policy which uses the Let's Encrypt certificate.
  When in TTP mode, the back-end server which uses Letsencrypt certificate should have port 80 enabled.
  Redirect HTTP to HTTPS should not be enabled when the validation is in process.
• TLS-ALPN-01: This method allows Let's Encrypt to send HTTPS requests to FortiWeb for validation. You must select HTTPS service in the server policy which uses the Let's Encrypt certificate.
• DNS-01: This method allows Let's Encrypt to do validation through your DNS provider. FortiWeb will generate a TXT record, then you need to add this TXT record to the DNS record. Refer to "Fulfilling the DNS-01 challenge" in FortiWeb Administration Guide.

key-type {RSA-2048 | RSA-3072 | RSA-4096}

Select Key Type. RSA algorithm with different key length can be implemented and accepted by the Let’s Encrypt Server. Those key sizes are 2048, 3072, and 4096 bits. Please note that larger keys consume more computing resources, however, achieve better security.

retry-times <integer>

The number of times FortiWeb polls the CA for the authorization status before timing out. Increase this value if your CA or DNS provider is slow to update/respond. Range: 5–20.

acme-email <string>

The contact email registered with the CA. The CA uses this to send expiration warnings if the automated renewal fails, or for critical security notices.

acme-service {letsencrypt | other}

Choose the CA that will issue your certificate:

• letsencrypt — The default non-profit CA. This allows for an anonymous, automated handshake without prior account setup.

• other — Select this option if you are using a commercial or enterprise provider (e.g., ZeroSSL, Sectigo, or a private CA).

acme-service-url <string>

Provide the directory URL for the third-party CA. Only required if acme-service is set to other.

acme-eab {enable | disable}

Enable this and select a pre-configured EAB Account. This links your FortiWeb to your specific corporate or paid subscription at the CA. If ACME EAB is disabled, the certificate issuance will fail when the provider requires the EAB credentials.

status <integer>

Displays the certificate status.

• 3 (Pending) — Manual action required (e.g., adding a TXT record for DNS-01).

• 6 (Success) —Certificate is issued and active. This certificate can now be referenced in the Server Policy.

• 7 (Failed) — Request failed; check network connectivity or CA rate limits.

expire-date <string>

Displays the expiration timestamp. FortiWeb uses this date as the baseline to trigger renewals based on the renew-period.

certificate <userdef>

Displays the PEM-formatted public certificate string obtained from the CA after successful issuance.

private-key <userdef>

Displays the PEM-formatted private key generated locally by FortiWeb for this certificate request.