Staff

Troubleshooting Tip: MacOS persistent agent SSL_get_verify_result = 14

Forum|Forum|2 years ago
May 10, 2024
0 replies
819 views

Description

This article describes a scenario where the Persistent Agent on a MacOS device is unable to communicate with FortiNAC, and agent logs show the following error:

SSL_get_verify_result = 14
SSL Certificate verification result: unable to get local issuer certificate

Scope

FortiNAC, MacOS.

Solution

Though this error refers to a specific OpenSSL error code 14 - 'the certificate notAfter field contains an invalid time' - this may be misleading.

Pay attention to the error code output 'SSL Certificate verification result: unable to get local issuer certificate'.
Ensure that the full cert chain is installed on both the client and the FortiNAC server in the Persistent Agent target. Most importantly, the intermediate root certificate(s), must be installed on FortiNAC if the chain uses any.

Related articles:

Technical Note: Troubleshooting the Persistent Agent

Technical Tip: Persistent Agent MacOS TLS Handshake Issue

Technical Tip: Persistent Agent fails to communicate with 'SSL_get_verify_result' log entry

Technical Tip: Verify trusted Certificate Authorities on Windows or Mac OSX