Skip to content
Docs sslbrain sslbrain.com

Fortinet FortiNAC

Copy link to the page “Fortinet FortiNAC”

← All integrations

Identity and remote access

Renews the certificate of one FortiNAC target, Admin UI, portal, Persistent Agent, RADIUS (EAP) or RadSec, via the REST API.

The appliance runs the package and connects to Fortinet FortiNAC through FortiNAC REST API v2 over HTTPS on port 8443. No agent is installed on Fortinet FortiNAC.

What happens

  1. The appliance connects to Fortinet FortiNAC through FortiNAC REST API v2 on port 8443.
  2. Certificate, RSA key and chain are uploaded to the chosen target. Other targets and trust stores are left alone.
  3. Only the chosen target is restarted, when FortiNAC asks for it. FortiNAC as a whole is never restarted. If it fails: If the target answered before the switch and no longer does, the deployment is reported as failed. When the rule's failure policy rolls back, rollback uploads the previous certificate to that target again and restarts only that target.
  4. Verification: the package fetches the certificate the target serves and checks certificate, chain and name. RADIUS (EAP) is checked in the configuration. If it fails: If the target still serves the old certificate, the switch is reported as not done and nothing is put back.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to FortiNAC REST API v2, port 8443. No agent is installed.
Service ports
8443
You need
A token for a REST API administrator whose Allowed Subnets include the address the package comes from: the appliance or the server that runs the package, after NAT. Discovery finds the targets, and the rule picks one.
Platform
FortiNAC-F 7.x and FortiNAC 9.x with REST API v2
Actions
Discovery, Installation, Verification, Rollback
Packages
fortinac 1.0.0
Note
  • Rollback puts the previous certificate back only when the package's own switch broke a target that answered before. A target that answers is left alone, also when the rule rolls back every target, and the rollback is then reported as refused.
  • Rollback cannot restore an Admin UI that no longer answers, because the REST API uses the same port. That is fixed in FortiNAC.
  • When the API certificate is pinned with MANAGEMENT_TLS_PIN_SHA256, renewing the Admin UI changes the pinned certificate. The result gives the new fingerprint to update the pin to.
  • FortiNAC-F 7.x and FortiNAC 9.x use the REST API administrator's token as a Bearer token.
  • RSA keys only, as Fortinet documents. Remote API targets and trust stores are not offered.
  • In HA, Fortinet does not document how a change reaches a given member. When a target appears more than once, the package warns.
  • Discovery finds the targets, the certificate each target is configured with, and the certificate on the API port.

Get started