[Fortigate Firewall] Certificate based Site-to-site IPsec VPN (certificate authentication)

How to configure Site-to-site IPsec VPN with certificate authentication ================================
Please donate to support the channel:
UPI: techtalksecurity@axl
PayPal: [e-mail]
================================

[@FaizAhmad-ib8kn]

Hi...Thanks for the cert based video. There is one confusion related to cert. Is the peer ca cert is from remote end firewall cert?

[@sumitnick4]

Yea, the remote end CA cert was used to generate the server (firewall) cert for peer.

[@FaizAhmad-ib8kn]

Is the ca cert from fortigate Firewall will be required in remote end Firewall to import and call it in IPsec tunnel?

[@sumitnick4]

You just need to import the CA cert to cert CA store on remote end, so that remote end can trust the server cert.

[@FaizAhmad-ib8kn]

@@sumitnick4 Thank you. I want to create tunnel between two Fortigate Firewall. I have generated CSR from my firewall and given to our CA team. They have generated it and I imported. When I imported in my firewall, one is under local cert another is under remote CA cert not the local CA cert. Just need clarification that now we need CA cert from remote end fortigate firewall to import it in our firewall and likewise I will provide my remote CA cert to remote firewall admin to import it in their end. When creating the tunnel, I will call the local cert in firewall and call the remote end CA cert in peer ca cert section and same thing will be done by remote end admin. Will it work for tunnel establishment?