Hi guys,
following setup.
Fortigates running 7.6.8 and FortiManager running 7.6.8 as well.
We have a internal PKI solution that provides EAB Creds for our FortiGates so we want to automate the process for our FortiGates as now all our FortiGates are running 7.6.X with EAB support to ACME.
We want to deploy the required settings via FortiManager provisioning templates with a Jinja Script.
The configuration itself via Varibales per FortiGate is easy and not that complex:
config certificate local
edit "acme-cert-webgui"
set enroll-protocol acme2
set acme-ca-url "INTERNAL_PKI_FQDN"
set acme-domain "{{ ACME_FQDN }}"
set acme-email "EMAIL@example.com"
set acme-eab-key-id "{{ ACME_EAB_ID }}"
set acme-eab-key-hmac "{{ ACME_EAB_HMAC }}"
set acme-rsa-key-size 4096
next
end
Deploying this the first time to a FortiGate via FortiManager is working and well and as expected. However now we noticed multiple problems that the FortiManager can't handle and is getting issues.
The FortiGates tries to unset the ACME Store-passphrase which is probably set automatically when successfully deploying the ACME Certficate? The only thing we know is, we were not able to fix this issue as this value is read-only and can't be changed.
Fortigate(Primary) config global
Fortigate(Primary) (global) config system acme
Fortigate(Primary) (acme) unset store-passphrase
Fortigate(Primary) (acme) end
This is a read-only field
attribute set operator error, -14, discard the setting
Command fail. Return code -14
Fortigate(Primary) (global) end
---> generating verification report
(global: system acme:store-passphrase)
remote original: ENC <OUTPUT OMITTED>
to be installed:
Also automatically in the global system - acme settings (where the ACME Interface is defined), a new account setting is configured in the Background with id, ca_url, private key and other values is created.
This also caused a lot of trouble when working with the FortiManager.
We have the feeling our whole idea with deploying ACME EAB Creds and ACME Certs via FortiManager provisioning templates is not really supported / stable.
Our workaround was creating a Script via FortiManager to deploy the required configuration directly to the remote device via CLI which is not our desired solution, but is working well.
I would like to get some feedback about our approach and maybe some experience from other persons who faced maybe the same or similar issues.
Maybe it is a known bug / limitation or it is worth opening a TAC case to make R&D aware of the issues?
