Troubleshooting Tip: Resolving FortiClient not submitting files to FortiSandbox after FortiSandbox upgrade in v5.0.6

Description

This article describes how to resolve the issue when FortiClient no longer submits files to a FortiSandbox after upgrading FortiSandbox to v5.0.6.

Scope

FortiSandbox, FortiClient EMS.

Solution

By default, FortiSandbox in v5.0.6 uses a CA2-issued certificate (SubCA2001). This is the recommended and supported default because CA2 has been deployed across Fortinet products for many years.

However, some legacy Fortinet devices in the field, especially those running older firmware versions or older hardware models, may not properly recognize certificates issued by newer CA chains such as SubCA2001 or SubCA2003.

In these cases, affected devices may fail to establish SSL communication with FortiSandbox when it presents a CA2-issued certificate.

In such a case, the FortiClient EMS may no longer be authorized on the FortiSandbox.

To maintain backward compatibility with legacy deployments, FortiSandbox provides an option to fall back to using a CA1-issued device certificate.

Use the following CLI command:

device-ssl -k

After applying the fallback configuration, FortiSandbox will use the CA1 device certificate, allowing older devices that do not properly recognize newer CA chains to establish SSL communication successfully.

FortiClient should resume with the file submission.

Remember to check if the FortiClient EMS is correctly authorized on the FortiSandbox after the change.

Notes:

• CA1 fallback should only be used for compatibility with legacy devices.

• Newer Fortinet products and firmware versions should support CA2 and CA bundles properly.