Technical Tip: SSL VPN using smartcard certificate with PIN does not work with TLS v1.3 on Windows 11

SSL VPN debug with no client certificate.

2025-07-28 14:16:46 [393:root:142b0]disable RSA-PSS sigalgos.
2025-07-28 14:16:46 [393:root:142b0]SSL state:before SSL initialization (106.220.188.184)
2025-07-28 14:16:46 [393:root:142b0]SSL state:fatal decode error (106.220.188.184)
2025-07-28 14:16:46 [393:root:142b0]SSL state:error:(null)(106.220.188.184)
2025-07-28 14:16:46 [393:root:142b0]SSL_accept failed, 1:unexpected eof while reading
2025-07-28 14:16:51 [395:root:142af]No client certificate
2025-07-28 14:16:51 [387:root:142af]no SNI received
2025-07-28 14:16:51 [387:root:142af]client cert requirement: yes
2025-07-28 14:16:52 [387:root:142af]sslvpn_update_user_group_list:1792 cert peer check failed, ignore peer user group(s) which has set user-peer in auth rules
2025-07-28 14:16:52 [387:root:142af]sslvpn_update_user_group_list:1850 got user (6:0), group (6:0), peer group (1) after update.
2025-07-28 14:16:52 [387:root:142af]sslvpn_authenticate_cert_start:391 No client certificate received.
2025-07-28 14:16:52 [387:root:142af]sslvpn_authenticate_cert_start:391 No client certificate received.
2025-07-28 14:16:52 [387:root:142af]login_failed:480 user[e26flb1],auth_type=32768 failed [sslvpn_login_cert_checked_error]

FortiGate configuration:

kaon-kvm46 # config vpn ssl settings
kaon-kvm46 (settings) # show full | grep ssl
config vpn ssl settings
    set ssl-max-proto-ver tls1-3 
    set ssl-min-proto-ver tls1-2
    set ssl-insert-empty-fragment enable
    set ssl-client-renegotiation disable

As a workaround, disable TLS 1.3 and set the max version to TLS v1.2. 

config vpn ssl settings
    set ssl-max-proto-ver tls1-2