The Importance of Automatic Certificate Renewal with FortiWeb

Apr 21, 2025 | Elden Quesinberry

Introduction: The Changing State of SSL/TLS Certificates

The lifespan of SSL/TLS certificates is shrinking. Tech giants like Apple and Google are pushing for shorter certificate lifespans, reducing the validity period from years to just 47 days by 2029 (https://www.sectigo.com/resource-library/apple-now-joins-google-in-push-to-shorten-digital-certificate-lifespans). While this improves security by limiting the time a compromised certificate can be misused, it also creates a management headache for IT teams.  Manual renewal is outdated, time-consuming, and prone to mistakes—one missed renewal can take down a critical website. That’s where automation comes in. The ACME protocol, used with tools like Certbot, streamlines the process, ensuring certificates are always up to date without human intervention.

FortiWeb Overview

FortiWeb from Fortinet is more than just a Web Application Firewall (WAF); it’s a security powerhouse designed to protect web apps from threats like SQL injection, cross-site scripting (XSS), and bot attacks. It goes beyond traditional firewalls by using machine learning and threat intelligence to detect and block malicious activity in real time. FortiWeb comes in different flavors, including hardware appliances and virtual machines, making it flexible enough for various deployment needs. Whether you’re securing an on-premises data center or a cloud-based app, FortiWeb provides the protection needed to keep your web services safe.

Automating Certificate Renewal with FortiWeb

As discussed above, renewing SSL/TLS certificates manually is highly inefficient. FortiWeb provides a seamless way to automate this process. By leveraging the ACME protocol, FortiWeb communicates directly with Certificate Authorities (CAs) to request, validate, and deploy new certificates before expiration. 

Tech Tip: The SSL/TLS certificate renewal mechanism is built right into the management interface.

This eliminates the risk of service downtime due to forgotten renewals. Depending on the firmware version, the FortiWeb can utilize three methods to accomplish this:

• HTTP-01: Uses an HTTP request over port 80 to verify domain ownership. This method is simple and widely supported but requires the server to be publicly accessible.
• TLS-ALPN-01: A more secure verification method that uses HTTPS (TLS Application-Layer Protocol Negotiation) over port 443. This ensures validation happens directly over an encrypted connection.
• DNS-01: Instead of relying on web-based verification, this method validates domain ownership by updating DNS records. It’s useful for environments without direct inbound web access.

Compared to some other solutions, FortiWeb’s integration of ACME is more secure and efficient, as it automates the entire lifecycle of certificate management while maintaining a high level of protection against cyber threats.

Conclusion

With SSL/TLS certificate lifespans shrinking and security threats increasing, manual renewal just isn’t practical anymore. Automating the process with ACME and FortiWeb ensures your certificates stay current without the risk of downtime or security gaps. On top of that, FortiWeb delivers enterprise-grade web application protection, making it a smart choice for organizations that need both security and reliability. If you’re still handling certificate renewals manually, it’s time to modernize and FortiWeb has you covered.

Would the FortiWeb’s WAF protection or automated certificate renewal process benefit your organization?

At Layer8, we’ve successfully deployed WAF solutions to protect web accessible applications from attacks . If you’re ready to explore how Fortinet’s FortiWeb can secure and improve your network, our engineers are here to help.

Contact us today for a free consultation, and let’s discuss how to make your network more intelligent, faster, and more resilient.

Frequently Asked Questions:

• How do I automate my SSL/TLS certificate renewal?
  • To automate the certificate renewal on a FortiWeb, the name and IP address of the certificate is configured and generated on the FortiWeb.  Then a user needs to choose whether the ACME process will use HTTP, TLS, or DNS for verification.  After verification has completed, the certificate will be used for security and will be automatically renewed before the validation period has expired.

• What happens when the FortiWeb license expires?
  • The FortiWeb will no longer receive signature updates.  In addition to this, a Fortinet support case can not be opened for troubleshooting and the FortiWeb won’t be permitted to do any firmware upgrades.

• How does the acme protocol work?
  • The ACME protocol automates certificate renewal by allowing a client to request a new certificate from a CA before the old one expires. The client proves domain control through challenges (like HTTP-01 or DNS-01), and if successful, the CA issues a renewed certificate. This process is typically automatic and requires minimal user intervention once set up.
    
• What does ACME stand for in certificates?
  • ACME stands for Automatic Certificate Management Environment. It’s a protocol developed by the Internet Security Research Group (ISRG) to automate the process of domain validation, certificate issuance, and renewal—primarily used by Let’s Encrypt.