FortiEMS auto renew SSL certificate using DNS-01 Challenge

Help
1

Good morning all!

I'm having issues trying to find solid documentation / instructions on how I can auto renew the SSL certificate for FortiEMS. We currently renew via HTTP-01 but this relies on us letting Port 80 through the firewall at the time of renewal. To save any issues going forward I want to move to use DNS-01 challenge using Akamai Edge DNS.

I think we have to use Certbot to create the certificate which needs adding as a TXT record into Akamai, but the part I'm struggling with is how to set up the auto renewal? I've read somewhere about using the Akamai API, but I'm not sure how this works or how to set it up.

If anyone has done this before or has any pointers then they'd be greatly appreciated!

Thanks!

2

Welcome @thomas.harris

What ACME Client are you using today to auto-renew using HTTP challenge? Is that built in to FortiEMS?

Certbot is just one of many ACME Clients. It is popular but for Akamai Edge DNS integration an ACME Client that supports it directly is probably better. See this page about the lego client for example: Akamai EdgeDNS :: Let’s Encrypt client and ACME library written in Go.

The lego ACME Client is often recommended on this forum.

If you don't get other suggestions here you might try the FortiNet forum too. See: https://community.fortinet.com/

3 Likes
3

Hi Mike,

Yes FortiEMS uses its own ACME client. After doing some digging it only appears to support HTTP-Challenge, so I think DNS is out of the question. I think the only way is to leave port 80 open or allow it through when the time comes for renewal.

One suggestion I've had is to leave port 80 open but restrict the firewall policy to only allow LetsEncrypt's IP ranges. Do you know the IP ranges for LetsEncrypt so I can test this?

Thanks

4

Let's Encrypt does not publish the IP ranges used. There are multiple centers around the world which rotate IP regularly.

Is it possible to request a cert outside of FortiEMS and upload it to that device? Such as using that lego ACME Client I suggested for the DNS Challenge?

3 Likes