Technical Tip: 'Invalid wildcard certificate' is seen when trying to connect a FIPS FortiGate to a FortiAnalyzer

Description

This article describes why 'Invalid wildcard certificate' is seen when trying to connect a FIPS FortiGate to a FortiAnalyzer.

Scope

FortiOS in FIPS mode.

Solution

When connecting a FortiGate in FIPS mode to a FortiAnalyzer, a certificate for client authentication must be presented to the FortiAnalyzer. 
More details on the certificate requirements for this connection can be seen here:
Technical Tip: FortiGate is not able to send logs to FortiAnalyzer with FIPS -CC mode enabled in version 7.2.5

After trying to select a certificate with 'set certificate xxxxx', 'Invalid wildcard certificate' may be seen:

This is because of the SAN in the Certificate. The certificate used for this purpose cannot have more than one subdomain in its SAN. For example, www.xxx.yyy.zzz will not work, but xxx.yyy.zzz will.

'client-bad' will hit this issue, as there are two subdomains:

'client-good' will not hit this issue, as there is only one subdomain:

When 'client-good' is used, the FortiGate accepts it: