Troubleshooting Tip: VPN with Smart Card PKI authentication, FortiClient VPN progress failed at 40% and would not ask for PIN code

VPN setup:

1. Follow this document: SSL VPN with certificate authentication and configure SSL VPN or IPsec VPN with certificate authentication.
2. Follow this document SSL VPN and configure the VPN to 'Require Certificate'.

Note: In some cases, additional settings on FortiGate may be required, depending on the article Technical Tip: Upgrade to the latest MS Windows 10 version breaks the SSLVPN login using PKI with some crypto cards:

config vpn ssl settings
    set client-sigalgs no-rsa-pss
end

In a successful VPN scenario:

1. Select the correct certificate for VPN connection, and FortiClient will prompt the user to enter the PIN code for the certificate.

2. After inputting the correct PIN code, FortiClient will proceed with the VPN connection and connect successfully.

In a failure VPN scenario:

1. Select the correct certificate for VPN connection, FortiClient pauses the progress at 40%.

2. FortiClient did not prompt the user to enter the PIN code and dropped the VPN attempt abruptly.

When facing the above issue, follow the guidelines below to troubleshoot (applicable to both FortiClient VPN-only version and FortiClient full-version):

1. Check the machine's Windows version, which can be checked by running a CMD command: winver.
   Windows 10 version 17134 (21H1) or older: Use FortiClient v7.2.11+.
   Windows 10 version 19044 (21H2) or newer: Use FortiClient v7.4.3+.
   Windows 11 version: Use FortiClient v7.4.3+.
   
   
2. If the above has been verified but the issue still persists, open Registry Editor, go to HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\Sslvpn\Tunnels\tunnelname.

• Check if there is a dual_stack registry; by right, there should be none; if it exists, it should be set to 0.

• In case the dual_stack registry exists and has been set to 1, manually edit it to 0.
• If the FortiClient is managed by EMS, manually add/edit the parameter <dual_stack>0</dual_stack> in the endpoint profile.

3. If the issue persists even after dual_stack is set to 0, add an async_mode registry (DWORD 32 bit) and set it to 1.

If the FortiClient is managed by EMS, manually add the parameter <async_mode>1</asycn_mode> in the endpoint profile.

After verifying all 3 steps above, the issue should be resolved.

Further reading about async_mode: Asynchronous Operation.