Technical Tip: Difference between 'auth-cert' and 'admin-server-cert' for IPsec SAML certificate presentation

Description

This article describes the different roles of auth-cert and admin-server-cert when troubleshooting the certificate presented by the HTTPS endpoint used for IPsec VPN SAML authentication.

Normally, auth-cert defines the certificate for HTTPS user authentication. In a few cases, the endpoint still presented the default Fortinet certificate, and assigning the same certificate to admin-server-cert corrected the presentation.

Scope

FortiGate, SAML.

Solution

1. Understand the purpose of each setting.

• auth-cert: Defines the certificate used for HTTPS user authentication. For IPsec SAML, this is the expected setting for the certificate presented by the authentication endpoint.

• admin-server-cert: Defines the certificate used for FortiGate HTTPS administrative connections. In the observed cases, this setting also influenced the certificate presented on the IKE SAML authentication listener.

The settings are separate. admin-server-cert is not a replacement for auth-cert. When testing the workaround below, keep auth-cert configured and use the same certificate in both locations.

2. Configure and validate auth-cert.

config user setting 
    set auth-cert <certificate>
end

The certificate must contain the SAML gateway FQDN in the Subject Alternative Name (SAN), include the corresponding private key, be within its validity period, and present a trusted certificate chain.

3. Access the URL on the browser to verify the certificate presented by the IKE SAML endpoint.

https://<saml-fqdn>:<auth-ike-saml-port>/remote/saml/metadata/

A certificate with the FortiGate serial number as the subject, or a browser error such as NET::ERR_CERT_AUTHORITY_INVALID, may indicate that the default Fortinet certificate is being presented.

4. As a workaround: Test admin-server-cert if the default certificate is still presented.

Record the current admin-server-cert value i.e. the same certificate used under auth-cert.

config system global 
   set admin-server-cert <certificate>
end

Retest the metadata URL and the IPsec SAML connection. The expected result is that the configured certificate is presented and the browser or FortiClient can continue to the SAML authentication flow.

Note: Changing admin-server-cert can also change the certificate presented by the FortiGate administrative GUI. Confirm that the selected certificate is suitable for administrative access before applying this change.