Technical Tip: Unable to connect to SSL VPN due to 'Certificate check error failed'

When SSL VPN is configured to authenticate using the client certificate but unable to connect to the VPN.

In the SSL VPN debugs, the following error appears:

This issue appears when the PKI user created on the firewall is not configured correctly.

config user peer

    edit "ABC"

        set ca CA_Cert_1

        set subject 'C =SG, ST =abc, L =abc, O =xyx, OU =User1, CN =User01, emailAddress =domain.com

    next

end

The certificate used has been configured with specifying space between the attributes (for example C = SG, ST = abc). However, the firewall subject is configured without having any space (C =SG, ST =abc ). So in debugs, the configuration on the firewall and certificate is mismatched which does not authenticate the user.

After specifying the space under FortiGate configuration as set subject C = SG, ST = abc, L = abc, O = xyx, OU = User1, CN = User01, emailAddress  = domian.com user should be able to authenticate.