Technical Tip: Filter client certificates in FortiClient

Sometimes, in the endpoint, there might be many client certificates available in the personal certificate store, and it could be tedious for the end user to know which client certificate to select to establish a VPN tunnel.

It is possible to use an XML certificate tag to filter based on the common name and issuer. For instance, if it is desired to filter to only show certificates issued by MANGOCA, include the following XML tags:

To filter only client certificates issued by MANGOCA, include the following XML code:

SSL VPN: 

<sslvpn>

<connections>

<connection>

<name>Lab SSL VPN</name>

<certificate>
<common_name>
<match_type>wildcard</match_type>
<pattern>*</pattern>
</common_name>
<issuer>
<match_type>simple</match_type>
<pattern>MANGOCA</pattern>
</issuer>
</certificate>

</connection>

</connections>

</sslvpn>

IPsec VPN: 

<ike_settings>

<auth_data>

<certificate>
<common_name>
<match_type>wildcard</match_type>
<pattern>*</pattern>
</common_name>
<issuer>
<match_type>simple</match_type>
<pattern>MANGOCA</pattern>
</issuer>
</certificate>

</auth_data>

</ike_settings>

Results: