Skip to main content
Anil_Solakoglu
Staff
Anil_Solakoglu
Staff
September 16, 2024

Technical Tip: How to verify ZTNA tag with certificate rule type

  • September 16, 2024
  • 0 replies
  • 1114 views

Description

This article describes how to adjust and cross-verify the ZTNA tag with the certificate rule type.

Scope

FortiClient.

Solution

Forticlient checks the current user's personal store and local computer store against possible matches based on the CN field on both issuer and subject fields.

 

Related document:

Zero Trust tagging rule types

 

To cross-verify this behavior via certutil tool can be used to grab more details.

 

certutil -dump path\to\certificate.cer

 

Anil_Solakoglu_0-1726442582004.png

 

Anil_Solakoglu_1-1726442582005.png

 

Anil_Solakoglu_2-1726442582005.png

 

The specific logs will be located under (Only in debug mode from the applied system settings profile).

 

 <Forticlient_installation_Directory>\logs\trace

 

FortiESNAC file which is the latest updated.

 

Here is the sample output. :

 

[2024-09-16 01:11:43.0228246 UTC+02:00] [616:684] [FortiESNAC  1839   debug] checking rule 14

[2024-09-16 01:11:43.0281836 UTC+02:00] [616:684] [FortiESNAC  1505    info] checking user certificte store MY

[2024-09-16 01:11:43.0282300 UTC+02:00] [616:684] [FortiESNAC  1533    info] found cert, subject: 017069F920AE470B9B52DCA7DDC0DE06, issuer: FCTEMS8822004232

[2024-09-16 01:11:43.0282421 UTC+02:00] [616:684] [FortiESNAC  1910   debug] rule Certificate is matched.

 

[2024-09-16 01:11:45.5836359 UTC+02:00] [616:684] [FortiESNAC  370    info] Tag added: Certificate

 

[2024-09-16 01:11:45.5836648 UTC+02:00] [616:684] [FortiESNAC  381   debug] Current tags: Compilent|CONNECTED_EMS|AV|Untrusted_Endpoints|Certificate

 

If there are still observed issues after the provided steps, a support ticket can be created to troubleshoot further details.

 

Terms & ConditionsAccessibility statement