Troubleshooting Tip: FortiClient EMS certificate not authorized

This error occurs when the EMS certificate cannot be validated against a remote CA. The first step is to ensure that all certificates in the chain of trust are installed on the FortiGate.

For instructions on installing the certificates, see this article: Technical Tip: FortiGate HTTPS/SSL Certificate Installation (PFX, PKCS12, PEM and CER).

If the certificates have already been installed and the error persists, run fcnacd debug to determine the cause of the issue.

diagnose debug reset

diagnose debug application fcnacd -1

diagnose debug console timestamp enable

diagnose debug enable

Check for the following error:

[__worker_handle_certinfo:292] Certificate callback error -1: Error (-1@_check_verify_ems_ca:759). CMDB error: ems 1 (ems.domain.com) has verifying CN but not CA CN. (_dup_and_check_server_cert_cn_ca,876) (_duplicate_and_check_server_certificate,960)Failed to handle server certificate CN and verifying CA.

This can be resolved in two ways.

1. Configure the CA certificate in the FortiClient EMS settings:

config endpoint-control fctems

    edit <id>

        set verifying-ca <certificate>

    next

end

2. Disable the trust-ca-cn setting:

config endpoint-control fctems

    edit <id>

        set trust-ca-cn [enable*|disable] <-- default value of 'trust-ca-cn' is 'enable'.

    next

end

For more information about how the trust-ca-cn setting works, see the documentation Allow FortiClient EMS connectors to trust EMS server certificate renewals based on the CN field.

If the certificate is signed by a public CA, in a normal scenario, FortiGate should be able to validate it using the pre-installed Root CA certificate in the Certificate Bundle, which should automatically appear in the 'verifying-ca' option.

If the certificate could not be validated, it is recommended to check whether FortiGate has installed the latest Certificate Bundle from the FortiGuard update. Certificate Bundle version can be verified by the command:

diagnose autoupdate version | grep -A5 Certificate

Non-Root FortiGate cannot set verifying-ca in Security Fabric:

When attempting to set `verifying-ca <certificate>` on a non-root FortiGate, it results in the error: 'Modification not allowed unless 'configuration-sync' is set to 'local''.

Solution Steps:

1. Set FortiGate to Standalone Mode under Fabric Connectors -> Standalone.
2. Configure the CA Certificate in the FortiClient EMS settings.

config endpoint-control fctems
    edit 1
        set verifying-ca <certificate>
    next
end

3. After setting 'verifying-ca', check if the FortiClient EMS is connected. If the status is connected, proceed to the next step.

Note:

Verify the correct CA certificate by checking the serial number when selecting 'Authorize' on the non-root FortiGate.

4. Rejoin Security Fabric under Fabric Connectors -> Join Existing Fabric. This should allow the non-root FortiGate to apply the CA certificate successfully.