Skip to main content
slabrie
New Member
March 2, 2023
Question

FortiSIEM with certificate from Microsoft AD CS

  • March 2, 2023
  • 4 replies
  • 3426 views

Hello,

Since I did the integration of an SSL certificate signed by a Microsoft ADCS certificate authority. I have SSL errors in the phoenix.log related to the phMonitorSupervisor. And in the Cloud Health section, the supervisor status is critical.

phMonitorSupervisor[1519691]: [PH_HTTP_CLIENT_CURL_ERROR]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phHttpClient.cpp,[lineNumber]=882,[infoURL]=h_t_tps://*.*.*.*:443/phoenix/rest/sync/task?custId=1&agentId=1&time=1677772602,[phLogDetail]=curl error (60) Peer certificate cannot be authenticated with given CA certificates for method: GET



On the other hand, I have a valid certificate when I connect in the WEBUI of FortiSIEM.

In the FortiSiem documentation, it describes the procedure to add a signed certificate. But I have an impression that it is only for CA authorities like Entrust, etc.

So, should we add the root CA of ADCS in the OS certificates (rocky Linux)?

Thanks for your help

#fortisiem

4 replies

FSM_FTNT
Staff
Staff
March 9, 2023

I think in this instance it may be best to raise a support case.

 

You should not need to install it into any Rocky cert stores. A few things to double check..

 

1 - certificate configuration

2 - dns name and any alt names provided

3 - verify certificate validity

 

slabrie
slabrieAuthor
New Member
March 16, 2023

Thanks for the reply

 

I will check with support. But I confirm that my certificate is valid, the dns and I have followed the configuration guide.

martinschmitt1
Visitor III
March 22, 2023

Hi Slabrie,

 

any outcome or news regarding using MS AD Certs? I also opened a case with support and i will configure it next week. 

martinschmitt1
Visitor III
March 10, 2023

Hello Slabrie,

 

i also want to implement an MSAD signed Cert but i did not try it because i read it that it seems not to be supported. I think the reason is there is only one Cert implemented for SSL and this is used in many places like connecting to the other FortiSIEM Appliances like Connectors and to external logsources like Azure and so on. Are you using this and is it still working in your case? Please let me know news about the outcome of your "experience". 

 

Good Look!

Martin

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.