Sign in to Next-Gen Trust Security.
Click Insights > Certificate Installations > Machines.
Click New, and then select Fortinet FortiWEB (Preview).
On the Properties step, in Name, enter a name for the machine.
(Optional) For
Authorized Workspaces, choose the workspaces to share the machine with. Sharing is supported for machines that use credentials you enter directly. To learn what other workspaces can do with a shared machine, see
Sharing Makes a Resource Visible Elsewhere.
For VSatellite, choose a VSatellite that can reach the machine. The list shows each VSatellite with the number of its active replicas.
In FortiWeb Hostname or IP Address, enter the hostname or IP address of the FortiWeb.
(Optional) In Admin HTTPS Port, replace the default, 8443, if you changed the admin HTTPS port on the appliance.
In Username and Password, enter the credentials of the FortiWeb administrator account.
Note: Next-Gen Trust Security encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.
(Optional) If the FortiWeb management interface uses a certificate signed by a trusted certificate authority (CA), enable Verify TLS Certificate. It's disabled by default, because FortiWeb appliances commonly use self-signed management certificates. When it's disabled, Next-Gen Trust Security doesn't verify the server certificate, but the connection is still encrypted.
Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.
Note: A successful test confirms that Next-Gen Trust Security can reach the FortiWeb REST API and that the FortiWeb accepts the credentials. It doesn't check the account's certificate, policy, or system permissions.
(Optional) For Discovery Types, select the kinds of certificates to discover. If you don't select any, discovery finds every type.
Management Interface: the certificate of the management interface.
Server Policy Certificates: certificates that a server policy uses.
SNI Certificates: certificates that a member of an SNI group uses.
CA Certificates: this type doesn't currently match any certificate, because discovery reads only the local certificate store.
Unbound Certificates: local certificates that no server policy or SNI group uses.
(Optional) For ADOM (leave blank to discover all), choose an ADOM to discover only that ADOM. If you leave it empty, discovery scans every ADOM the account can access. If ADOMs aren't enabled on the appliance, discovery scans the global scope and ignores this setting.
(Optional) To skip certificates that have already expired, enable Exclude expired certificates.
Discovery skips the FortiWeb built-in default certificates. If discovery can't read an ADOM's certificate store, it skips that ADOM and continues with the next one.
(Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
Click Continue. The Provisioning step opens.
(Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.
Click Finish.
