Technical Tip:How to Validate the Certificate on K-Series FortiAP (23xK, 24xK, 44xK)

Description

This article provides a step-by-step guide to diagnose and validate the certificate present on K-series FortiAPs when encountering DTLS errors while connecting to FortiGate.

Scope

FortiAP (23xK, 24xK, 44xK).

Solution

When a FortiAP does not come online on FortiGate and continuously reports DTLS errors, validate the following:

1. The console and DTLS logs should show a DTLS failure with an invalid certificate error.

00039.468 AC0,0 FSM0:old DTLS_SETUP(10) ev CWWE_DTLS_PEER_ID_RECV(46) new DTLS_AUTHORIZE(11)
00039.468 AC0,0 ==========================cwWtpFsmThread 8 2=========================
00039.469 AC0,0 ==========================cwWtpFsmThread 8 1=========================
00039.469 AC0,0 FSM0:old DTLS_AUTHORIZE(11) ev CWWE_DTLS_AUTH_FAIL(50) new DTLS_TD(13)
00039.469 AC0,0 CWWS_DTLS_TD_enter 0 START
00039.596 AC0,0 shell cmd run: killall lldpd
00039.615 AC0,0 cwWtpDlKernFlush - nothing needs to be done ????
00039.647 AC0,0 VBR IOC drv flush flush=1
00039.647 AC0,0 cwDevIoctl_ifru_data wldvlan 89f0 ERR - Invalid argument

Note: For DTLS-related issues, enable the following debug logs on the FortiAP and collect the logs through SSH:

cw_diag debug dtls 15
con
don

2. Disable DTLS debugging by setting the log level to 0:

doff
coff
cw_diag debug dtls 0

3. Verify that the required certificate is present on both the FortiGate and FortiAP using the following commands:

On FortiGate:

Device certificate:

get vpn certificate local details
get vpn certificate local details Fortinet_Factory
get vpn certificate local details Fortinet_Factory_Backup
get vpn certificate ca details
get vpn certificate ca details Fortinet_CA
get vpn certificate ca details Fortinet_Sub_CA
get vpn certificate ca details Fortinet_CA_Backup

On FortiAP:

cw_diag -c cert
cw_diag -c cert Fortinet_CA1.cer

4. If the 'cw_diag -c cert Fortinet_CA1.cer' command returns no output, log a ticket with Fortinet Support and attach the fap-tech, dtls log, certificate details, and the latest FortiGate config.