Technical Tip: ZTNA Web Portal certicate validation.

Description

This article describes how to troubleshoot the agentless ZTNA portal certification issue.

Scope

FortiOS v7.6.7 and v8.0.0.

Solution

If certificate verification is enabled for the ZTNA web portal as per the document ZTNA agentless web-based application access and certificate validation still fails - especially for agentless ZTNA web portal access - there may be errors encountered such as certificate validation failure when connecting to the server.

In such cases, disable certificate verification using the following configuration.

This issue is typically observed in logs like the ones below, where the certificate does not match the expected hostname:

[V][p:15871][s:200451] wad_ssl_port_caps_on_handshake_recv:13067 sp=0x7fb45df758/11 recv type=11 len=2574
[I][p:15871][s:200451] __wad_ssl_cert_open_cert :683 https server uses key_len 2048
[I][p:15871][s:200451] wad_ssl_cert_host_verify :93 cert '' not-match 'abc.com'
[I][p:15871][s:200451] wad_ssl_port_caps_1way_clt_on_srv_certs:15094 cert '' does not match hostname 'abc.com'
[I][p:15871][s:200451] wad_vs_ssl_port_caps_on_p2s_alert_sent:13343 fts send alert level=2 desc=certificate unknown
[V][p:15871][s:200451] wad_ssl_port_caps_on_enc_start :17649 sp=0x7fb45df758/11 enc start 0x7fb458fe88 type 21 ver 0303 len 2

These logs indicate that the server certificate is either invalid, untrusted, or does not match the requested domain.

To bypass certificate verification, apply the following configuration:

config ztna web-portal-bookmark
    edit "ABC1"
        set groups "ABCUSGR"
            config bookmarks
                edit "https"
                    set verify-cert disable
                    set url "https://abc.com/"
                next
            end
        next
    end