Skip to content
Docs sslbrain sslbrain.com

Fortinet FortiADC

Copy link to the page “Fortinet FortiADC”

← All integrations

Load balancer

Renews the certificate on a FortiADC virtual server and FortiADC's management HTTPS certificate through the REST API.

The appliance runs the package and connects to Fortinet FortiADC through FortiADC REST API over HTTPS on port 443. No agent is installed on Fortinet FortiADC.

What happens

  1. The appliance connects to Fortinet FortiADC through FortiADC REST API on port 443.
  2. Certificate and key are uploaded as a new local certificate, and the chain as intermediate CA certificates in an intermediate CA group the package creates. A certificate the package has already uploaded is reused. The key travels as PEM inside the verified TLS connection or, when you choose it, as PKCS12 under a one-time password.
  3. For a virtual server the package copies its local certificate group with the new certificate in the chosen member's place and points only its client SSL profile at the copy. The old group is not changed. For management the package switches FortiADC's HTTPS certificate in system global. If it fails: If the service answered before the switch and presents an unknown certificate afterwards, or a virtual server no longer answers, the package puts the previous one back in the same run and reports whether that worked. If the service still presents the old certificate, the switch is reported as not done and nothing is put back.
  4. Verification: the package reads the configuration again in a new request and fetches the certificate the service presents over TLS, from the virtual server's address and port or from the management connection. The result turns on whether that is the new certificate. When the service presents the new certificate, whether the server name is in it is reported too. If it fails: If the appliance cannot reach the virtual server, the package reports the result with a warning, based on the configuration.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to FortiADC REST API, port 443. No agent is installed.
You need
API key of a REST API administrator with read-write access. The key is sent only in the APITOKEN header, never in a URL, and the user name is not sent. Discovery finds the virtual servers that can be renewed, and the rule picks one of them or management.
Platform
FortiADC 7.4, 7.6 and 8.0 with a REST API administrator
Actions
Discovery, Installation, Verification, Rollback, Removal
Packages
fortiadc-api 1.0.0
Note
  • The package changes only the chosen virtual server's client SSL profile or the management certificate. Other virtual servers that use the same profile get the new certificate too, and the result names them. Other profiles that use the old group, and other certificates, are left alone.
  • When the package gets no answer to a change, it reads the FortiADC before doing anything more and never sends the same change twice. If someone else changed the profile or system global meanwhile, the package stops without writing.
  • Rollback points the profile or system global back at the previous certificate only while it still names what the deploy put there, and only when the service answered before and is broken now. Otherwise nothing changes.
  • Removal deletes only groups and certificates the package created itself, once nothing uses them any more, and reads afterwards that they are gone. If FortiADC refuses a deletion, the object stays and the result names it.
  • The connection to FortiADC is verified by default against the system trust store, a CA bundle or a fingerprint in MANAGEMENT_TLS_PIN_SHA256. After a management certificate switch the run accepts exactly the new certificate, and with a pin the result gives the new fingerprint to update the pin to.
  • When the appliance reaches the virtual server through NAT, the address, port and server name for the check go in FORTIADC_SERVICE_HOST, FORTIADC_SERVICE_PORT and FORTIADC_SERVICE_SNI.
  • In an HA cluster the package changes the unit it connects to, and certificates and keys reach the other members through FortiADC's HA synchronisation from the Configuration Source. Fortinet documents no REST call that shows a member has received the change, and the package runs none, so the result warns about the other members. Connect the package to the Configuration Source.
  • Fortinet documents no save command in FortiADC's REST API and does not describe when a REST change is saved; the package runs none. The package reads every change back in a new request. FortiADC may record API calls in its own logs, and the package does not turn logging off.
  • Discovery finds FortiADC's version, VDOMs, HA mode, management certificate, local certificates, certificate groups, intermediate CA groups, client SSL profiles and virtual servers, and which of them and the management certificate can be renewed.

Get started