A utility is choosing how the NOC FortiGate will authenticate to a new substation FortiGate for a site-to-site IPsec tunnel. Compared with a pre-shared key, what is the main operational advantage of using certificate-based authentication for this pair of peers?
Select an answer to reveal the explanation.
Short Explanation
A pre-shared key is one secret both sides must protect — if it leaks anywhere, anyone who has it can impersonate either end. Certificates swap that shared secret for individual identities that a trusted CA can vouch for, so each FortiGate proves who it is on its own rather than everyone relying on the same password.
Full Explanation
Certificate-based IPsec authentication replaces a single shared secret with per-peer identity: each FortiGate presents a certificate signed by a mutually trusted certificate authority, and the remote side validates that signature and identity independently, rather than both sides simply matching an identical pre-shared key. This removes the exposure risk inherent to any shared secret — if one peer's PSK configuration is ever compromised, an attacker can impersonate either end of that specific tunnel, whereas a compromised certificate can be revoked without affecting other peers using the same CA. The claim that certificates eliminate configuring phase 1 and phase 2 proposals is false — encryption, authentication, and DH group proposals still have to be negotiated regardless of which authentication method is used; certificates only change how peer identity is proven, not whether proposals exist. The option about stolen configuration files conflates certificate authentication with a general anti-theft property it doesn't uniquely provide; a stolen configuration exporting a private key could still be misused, so this overstates the benefit incorrectly. Certificates also do not guarantee stronger encryption — the actual cipher suite is still whatever is configured in the phase 1 and phase 2 proposals, independent of the authentication method chosen. To validate a certificate-based tunnel, check 'diagnose vpn ike gateway list' for the certificate subject presented by the peer and confirm the CA chain is trusted under 'config vpn certificate ca' on both FortiGates.