Fortinet FortiManager

Firewall and VPN

Installs FortiManager's own HTTPS certificate, or the admin HTTPS or SSL VPN certificate of a managed FortiGate.

What happens

The appliance connects to Fortinet FortiManager through FortiManager JSON API on port 443.
The certificate goes into FortiManager's own certificate store or, for a FortiGate, into FortiManager's device database. The same certificate already there is reused.
FortiManager selects it as its HTTPS certificate, or the chosen service on the FortiGate points to it and FortiManager installs the device settings on that FortiGate only. If it fails: If FortiManager's HTTPS stops working after the switch, the package tries to put the previous certificate back and reports whether that worked. If the install fails while the FortiGate still has the previous certificate, the package removes the run's own device-database changes, as long as nobody else has changed them. Rollback selects the previous certificate again when nobody else has changed the selection since.
Verification: the package reads which certificate FortiManager or the FortiGate configuration names and checks the certificate the service serves over TLS.

Connection: The package runs on the appliance, which connects over HTTPS to FortiManager JSON API, port 443. No agent is installed.
You need: API key of a REST API administrator, or an administrator name and password. The administrator needs read-write JSON API access.
Platform: FortiManager 7.0 and later; API key from 7.2.2
Actions: Discovery, Installation, Verification, Rollback, Removal
Packages: fortimanager-api 1.0.0
Note: The package needs appliance version 0.4.45 or later.
A FortiGate must be connected and in sync with FortiManager with no pending device-database changes, because Install device settings carries every pending change. In workspace mode the ADOM is locked during the change. Workflow mode is not supported.
The package switches only the service you chose and touches no other certificate. Removal deletes only a certificate the package created itself, once the chosen service no longer uses it. On FortiManager HA the certificate reaches only the unit the package connects to, and the result warns about the other units.
Discovery finds FortiManager's version, HA and workspace mode, its own HTTPS certificate and certificate store, ADOMs, and the FortiGates it manages with their connection and sync state and the certificate FortiManager's device database names for their admin HTTPS and SSL VPN.