Technical Tip: FortiSASE ZTNA Tagging Rule using Certificate

1. Create the Root Certificate on FortiAuthenticator. This root certificate is used to generate the relevant user certificate to be installed on the endpoint.
   
   

2. Generate the user certificate.
   
   

3. Take note of the Subject CN name and Issuer name, as it will be used in the ZTNA Tagging Rules configuration done on FortiSASE.
   
   

4. Select ‘Export Key and Cert’ to download the certificate. The certificate will be downloaded in the PKCS#12 format. This will then be installed on the client device.
   
   

5. A Windows client is used in this case. The certificate should be installed in the ‘Personal’ folder.

6. Screenshot shown here is for FortiSASE Feature Release. Go to Endpoint Management -> Security posture tags. Under Tags, select Create. The name of the tag in this case is ‘contractor-tag’.
   
   

7. Create the Tagging rules. In this case, a Windows-based tag is created. Wildcard is used where the Subject CN is ‘sase-contractor*’, and Issuer CN is ‘fortisase-root’.
   
   

Result:

FortiClient can be seen assigned the ‘contractor-tag’.

On FortiSASE, the relevant endpoint can be seen tagged with the ‘contractor-tag’ ZTNA Tag.