Technical Tip: How to obtain a Let's Encrypt SSL for a domain in FortiWeb with the True Transparent Proxy mode DNS validation type

[kmak]

Description	This article describes the steps necessary to obtain a Let’s Encrypt Certificate for a domain in FortiWeb with the 'True Transparent Proxy Mode' DNS validation type.
Scope	FortiWeb.
Solution	Prerequisites: DNS control of the domain. The DNS validation method does not renew automatically. These instructions require manual renewal of the certificate before it expires. A FortiWeb Let’s Encrypt SSL Certificate request does not support a wildcard subdomain SAN in the current version (v7.4.0). In FortiWeb, navigate to Server Objects > Certificates > Let’s Encrypt. Create a new Let’s Encrypt Certificate request. Select the DNS-01 request type, which means the Let’s Encrypt will use DNS TXT records to validate the domain ownership. Insert the name and the domain name. Add the SAN hostname to be included in the Let’s Encrypt SSL certificate. Select the 'issue' icon to initiate the Let’s Encrypt SSL request. The Let’s Encrypt SSL status will change to 'Need user to proceed manually'. Select and edit the Let’s Encrypt SSL object. There will be a button to download the DNS content file. Select and download the DNS content file. Open the downloaded DNS content file using a text editor to check the DNS TXT records. Add/update the DNS TXT records to the domain DNS zone and test the DNS records before validating from Let’s Encrypt. Go back to the FortiWeb Let’s Encrypt page. Select the process icon to start the DNS validation. The Let’s Encrypt SSL cert will show up with certificate revocation in progress. The Let’s Encrypt SSL certificate request will complete within 5 to 10 minutes. Refresh the page to check the certificate status. Now, navigate to the Server Pool page and update the SSL certificate settings for the related server pool. Edit the real server and enable the SSL settings. Select Let’s Encrypt for the Certificate Type and select the obtained Let’s Encrypt SSL certificate from the dropdown menu. Select OK to save the settings. To test, browse to a URL with the HTTPS protocol. It should load with the Let’s Encrypt SSL certificate. Related document: Let's Encrypt Certificates - FortiWeb Administration Guide.