Troubleshooting Tip: Unable to connect FortiClient EMS due to a server certificate

On CLI:

FGT-1 # diagnose endpoint fctems test-connectivity 1 Connection test had an error -4: EMS server certificate is not signed by any known CA.  FGT-1 # execute fctems verify 1 Error in requesting EMS fabric connection: -4 issue in getting capabilities. EMS server certificate is not signed by any known CA. Error (-1@_get_capabilities:461).  Command fail. Return code -9999​

Diagnostics:

Enable debugging in the firewall:

diagnose debug application fcnacd -1

diagnose debug enable

To disable it:

diagnose debug reset

Debug output:

obj-id: 0, desc: "REST API to get EMS Serial Number.", entry: "api/v1/system/serial_number".
error info: Error (-1@__generic_process_result_ex:158). EMS server certificate is not signed by any known CA.

This error occurs when the FortiClient EMS certificate fails validation against a remote Certificate Authority (CA). The initial troubleshooting step is to verify that all certificates in the trust chain, including intermediate and root certificates, are correctly installed on the FortiGate.

If custom certificates are used, the FortiGate must trust the entire certificate chain to authorize the FortiClient EMS server. If the root CA certificate has already been imported and the error persists, the most likely cause is that the intermediate CA certificate has not been correctly imported.

Verify the Server Certificate configured on FortiClient EMS to connect with FortiGate.

On FortiClient EMS:
Go to the System Settings -> EMS Settings -> Webserver certificate :

Here, the custom Certificate is configured as a Webserver Certificate.Check the CA of the server Certificate. It can be validated as shown below:

Here, the Server Certificate is signed by EMS-CA. Make sure to install the CA certificate on FortiGate.

On FortiGate:

Go to System -> Certificates -> Create/Import -> CA Certificate and import the CA certificate:

Note:

In case of using VDOMs, upload the certificate to the global VDOM besides the VDOM that the fabric connector is in.

Afterwards, FortiGate will be connected to the FortiClient EMS server.

FGT-1 # execute fctems verify 1 EMS already verified.  FGT-1 # diagnose endpoint fctems test-connectivity 1 Connection test was successful.