How to change Certificate on Fortinet FortiGate

FortiGate stores a certificate as a local certificate object, but each TLS feature selects its own object: administration, SSL VPN, virtual servers, explicit proxy, and other features are separate references.

Before you begin

Record the current certificate object name, VDOM/global scope, CA chain, and every feature that references it. Export the configuration. Prepare a PFX/PKCS#12 with its password or use the certificate issued from a FortiGate-generated CSR whose private key already remains on the device.

Step-by-step certificate replacement

1. In the correct VDOM, go to System > Certificates > Create/Import > Certificate.
2. For an externally generated key, choose PKCS #12 Certificate, upload the PFX, and enter its password. For a FortiGate-generated CSR, import the signed .cer as a Local Certificate so it pairs with the existing key.
3. Import missing intermediate/root CA certificates into the appropriate CA store. A local leaf import alone is not the served chain for every feature.
4. Update every intended consumer to select the new object, for example the HTTPS administrative certificate under system administration settings and the server certificate under SSL-VPN settings. Preserve VDOM scope and HA configuration.
5. Save/apply. FortiOS activates configuration changes without a general appliance reboot; existing sessions can continue until renegotiation.

Product-specific considerations

A certificate uploaded to a VDOM is available only to that VDOM; a Global VDOM import is globally accessible. Do not replace the management certificate and assume SSL VPN or a virtual server changed. In HA, verify certificate/config synchronization according to the FortiOS release and test each member.

Verify the new certificate

Inspect the local certificate object and chain, then connect separately to the admin GUI, SSL VPN, and every virtual server hostname. Test through the HA virtual IP and directly against members where the runbook permits it.

Rollback

Reselect the old object for each feature and restore the saved configuration if necessary. Keep the old CA chain until all client paths validate.

Common problems

• Leaf imported without the intermediate chain.
• Certificate imported in the wrong VDOM.
• New object exists but the feature still selects the old object.
• SAN does not cover the admin/VPN/virtual-server hostname.

Automating certificate replacement with aethercert

The aethercert FortiGate target imports the leaf certificate and private key as a named FortiOS local certificate. It does not import the chain as FortiOS CA objects or assign the certificate to a particular FortiGate feature; configure those product-specific references separately.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

Sources

• Fortinet: import a certificate in FortiOS