InfoSecMonkey: No fluff. Just the config that works.

Category Archives: Certificate

EJBCA Internal CA: Deploy a Private PKI for Your Local Servers with Docker
11 November, 2026

EJBCA Internal CA: Deploy a Private PKI for Your Local Servers with Docker

Deploy an EJBCA internal CA in Docker with MariaDB, build a two-tier Root and Issuing CA, and issue trusted TLS certificates to local servers.

Read More
FortiGate IKEv2 Certificate Pinning: Machine Certificate Plus EAP-MSCHAPv2 Remote Access VPN
10 November, 2026

FortiGate IKEv2 Certificate Pinning: Machine Certificate Plus EAP-MSCHAPv2 Remote Access VPN

Set up FortiGate IKEv2 certificate pinning: require a machine certificate from your own CA before EAP-MSCHAPv2 login, with OpenSSL and CRL.

Read More
eMudhra Certificate Compromise: What Broke and How to Clean Up Your Trust Stores
10 November, 2026

eMudhra Certificate Compromise: What Broke and How to Clean Up Your Trust Stores

The eMudhra certificate compromise explained: what broke, which clients are still exposed, and how to patch Linux, runtimes, endpoints and FortiGate.

Read More
FortiGate Incomplete Certificate Chain: Fixing the Missing GoDaddy Intermediate
9 November, 2026

FortiGate Incomplete Certificate Chain: Fixing the Missing GoDaddy Intermediate

Fix an incomplete FortiGate certificate chain: prove the GoDaddy intermediate is missing with OpenSSL, import it or rebuild the PKCS#12, then verify.

Read More
FortiGate and EntraID: Renewing an Expiring Entra ID SAML Signing Certificate Without Breaking SSO
15 October, 2026

FortiGate and EntraID: Renewing an Expiring Entra ID SAML Signing Certificate Without Breaking SSO

Learn how to renew an expiring Entra ID SAML certificate on FortiGate with zero downtime. Follow this step-by-step guide to stage and activate the...

Read More
FortiGate ACME Beyond Let’s Encrypt: ZeroSSL, Sectigo, and Internal step-ca
12 October, 2026

FortiGate ACME Beyond Let’s Encrypt: ZeroSSL, Sectigo, and Internal step-ca

Configure FortiGate ACME custom CA for ZeroSSL, Sectigo, or step-ca. Bypass Let's Encrypt limits with CLI commands for auto-renewal and EAB setup.

Read More
The 47-Day Certificate: The Whole Industry Is Going Let’s Encrypt’s ACME Model
12 October, 2026

The 47-Day Certificate: The Whole Industry Is Going Let’s Encrypt’s ACME Model

Understand the 47-day TLS certificate validity mandate from CA/B Forum Ballot SC-081v3. Learn how to configure FortiGate ACME for automated renewal.

Read More
The Clock Is Ticking: What CA/B Forum’s Ballot SC-081v3 Means for the Future of Web Security
23 July, 2026

The Clock Is Ticking: What CA/B Forum’s Ballot SC-081v3 Means for the Future of Web Security

Learn how CA/B Forum Ballot SC-081v3 mandates 47-day TLS certificates. Discover the phased timeline and how to automate certificate management before 2029.

Read More
The Certificates Your FortiGate Ships With, and What to Do With Them
23 July, 2026

The Certificates Your FortiGate Ships With, and What to Do With Them

Replace FortiGate default certificates for admin GUI, SSL VPN, and deep inspection. Learn which factory certs to keep and how to build your own...

Read More
The SSH Key Fallacy: Why Static Keys Are Not Access Control, and How to Fix It With an SSH Certificate Authority
22 July, 2026

The SSH Key Fallacy: Why Static Keys Are Not Access Control, and How to Fix It With an SSH Certificate Authority

Learn to build an SSH Certificate Authority setup. Replace static keys with short-lived, revocable certificates for secure, auditable access control.

Read More
Is your FortiGate vulnerable to Management Access when using a Let’s Encrypt Certificate
1 July, 2026

Is your FortiGate vulnerable to Management Access when using a Let’s Encrypt Certificate

Verify FortiGate Let's Encrypt security. Learn how the isolated ACME daemon handles validation without exposing your administrative GUI or management console.

Read More
Cert-Based Site-to-Site VPN on FortiGates using Open SSL as the CA – 2026 Version
2 May, 2026

Cert-Based Site-to-Site VPN on FortiGates using Open SSL as the CA – 2026 Version

Configure FortiGate site-to-site VPN using OpenSSL CA. Generate root and device certificates, create PKCS12 files, and apply IPsec settings for secure tunneling.

Read More
FortiGate IPsec Remote Access VPN with Computer Certificate Pinning
31 March, 2026

FortiGate IPsec Remote Access VPN with Computer Certificate Pinning

Configure FortiGate IPsec certificate pinning to restrict VPN access to authorized devices. Includes FortiAuthenticator CA setup and macOS client steps.

Read More
IPsec VPNs Deep Dive
16 February, 2026

IPsec VPNs Deep Dive

Learn to configure IPsec VPN phases and choose the right Diffie-Hellman group. Understand ISAKMP, IKE, and cipher suites for secure tunnel setup.

Read More
Extracting Private Key from FortiGate Firewall
30 August, 2022

Extracting Private Key from FortiGate Firewall

Export the FortiGate private key using the CLI show full command. Learn to generate a CSR and retrieve the key for wildcard certificate imports.

Read More
Extracting Your Private Key from a .pfx certificate
30 August, 2022

Extracting Your Private Key from a .pfx certificate

Extract private key from pfx files using OpenSSL commands. Learn how to export, decrypt, and validate keys for server or firewall deployment.

Read More
Converting Certificates using OpenSSL
30 September, 2021

Converting Certificates using OpenSSL

Every OpenSSL certificate conversion you are likely to need, re-tested on OpenSSL 3: PEM, DER, P7B, PFX, PKCS#8 and JKS. Includes the fix for...

Read More
Converting a PPK file to a PEM file
17 May, 2020

Converting a PPK file to a PEM file

Learn how to convert PPK to PEM files using puttygen on macOS and Linux. Includes steps to decrypt AWS Windows passwords and reverse conversion.

Read More