Secure connections and certificates
Page 105
FortiRecorder 2.4.2 Administration Guide
5.
Click
OK
.
The FortiRecorder appliance creates a private and public key pair. The generated request
includes the public key of the FortiRecorder appliance and information such as the
FortiRecorder appliance’s IP address, domain name, or email address. The FortiRecorder
appliance’s private key remains confidential on the FortiRecorder appliance. The
Status
column of the entry is
Pending
.
6.
Click to select the row that corresponds to the certificate request.
7.
Click
Download
.
Standard dialogs appear with buttons to save the file at a location you select. Your web
browser downloads the certificate request (.csr) file. Time required varies by the size of the
file and the speed of your network connection.
8.
Upload the certificate request to your CA.
After you submit the request to a CA, the CA will verify the information in the certificate, give
it a serial number, an expiration date, and sign it with the public key of the CA.
9.
If you are not using a commercial CA whose root certificate is already installed by default on
web browsers, download your CA’s root certificate, then install it on all computers that will
be connecting to your appliance. (If you do not install these, those computers may not trust
your new certificate.)
10.
When you receive the signed certificate from the CA, upload the certificate to the
FortiRecorder appliance (see
“Uploading & selecting to use a certificate”
Uploading & selecting to use a certificate
You can import (upload) either:
• Base64-encoded
• PKCS #12 RSA-encrypted
X.509 server certificates and private keys to the FortiRecorder appliance. The format of the
certificate file that you have, and whether or not it includes the private key, may vary.
If a server certificate is signed by an intermediate certificate authority (CA) rather than a root CA,
before clients will trust the server certificate, you must demonstrate a link with root CAs that the
clients trust, thereby proving that the server certificate is genuine. You can demonstrate this
chain of trust either by:
• Appending a signing chain in the server certificate.
• Installing each intermediary CA’s certificate in clients’ trust store (list of trusted CAs).
Which method is best for you often depends on whether you have a convenient method for
deploying CA certificates to clients, such as you may be able to for clients in an internal
Microsoft Active Directory domain, and whether you often refresh the server certificate.
To append a signing chain in the certificate itself, before uploading the server certificate
to the FortiRecorder appliance
1.
Open the certificate file in a plain text editor.
