Skip to main content
ebilcari
Staff
ebilcari
Staff
June 5, 2026

Troubleshooting Tip: Persistent Agent not picking up the certificate

  • June 5, 2026
  • 0 replies
  • 64 views

Description


This article describes a scenario where, due to configured Custom Scans that check certificates on the end host, the scan fails because the certificate is not detected by the agent.


958427c3.png

 

Scope

 

FortiNAC and Persistent Agent.


Solution


After a custom scan is configured as shown in Certificate check, and a scan is triggered from FortiNAC, in the agent logs, the following logs are expected:

<WinCertCheck>
<domain>
<netbios><![CDATA[EB]]></netbios>
<host><![CDATA[Win11-Sop]]></host>
<cert>-----BEGIN CERTIFICATE-----
MIIEzjCCA7agAwIBAgIJAOX4z4gw7+QoMA0GCSqGSIb3DQEBCwUAMIGMMQswCQYD
...
fLHixLQY+VyJ4j7DIM0WbvkXFvC9XKgTb86NXo9vxsl+1A==
-----END CERTIFICATE-----
</cert>
<sig>sha1WithRSA:boYGNG5JT8 ... 7nbTSlQzBVkQWAcQbCKmY2kg==</sig>
<time>1779269115000</time>
</domain>
</WinCertCheck>


If this part is missing in the agent logs, the certificate is not properly uploaded to the certificate store on the end host (Local Computer -> Personal -> Certificates), or the certificate format is not readable by the agent. Currently, this agent feature does not support certificate validation for certificates that are generated/signed by using the Cryptography Next Generation (CNG) framework.

A similar output can also be traced from FortiNAC by enabling the following debug:

fnac76 # diagnose debug plugin enable PersistentAgent
fnac76 # diagnose tail -f output.nessus


Related articles:

    Terms & ConditionsAccessibility statement