Staff

Technical Tip: How to configure mTLS (Mutual TLS) authentication on FortiWeb

Forum|Forum|6 months ago
January 26, 2026
0 replies
792 views

Description

This article describes how to configure mTLS (Mutual TLS) authentication on FortiWeb.

Scope

FortiWeb.

Solution

What mTLS authentication is:

mTLS (Mutual TLS) authentication is used to mutually authenticate both the client and the server [FortiWeb's server policy] by exchanging and validating certificates during the TLS handshake.

The difference between TLS and mTLS:

Typical TLS (HTTPS): FortiWeb presents the server certificate to the client only.

mTLS: FortiWeb presents the server certificate to the client And the client presents its client certificate to FortiWeb together to perform mutual TLS authentication.

How to perform mTLS authentication:

Part 1: FortiWeb presents its server certificate chain to the client to achieve Server authentication.
Part 2: The client presents its client certificate to FortiWeb to achieve Client authentication.

How to configure mTLS authentication on FortiWeb:

Part (1) Configure FortiWeb to present the server certificate chain:

Import both the intermediate and the root certificates at Server Objects -> Certificate -> intermediate CA.
Note: Importing only the Intermediate certificate sometimes can be enough however it is recommend to import both the Intermediate and the Root certificates.
Assign the Intermediate and the Root certificates in a Intermediate CA group at Server Objects -> Certificate -> Intermediate CA Group.
Import the Server certificate at Server Objects -> Certificate -> Local.
Assign the complete certificate chain at the server policy: Policy -> Server Policy -> Choose the related policy: Assign the imported certificate chain at 'Certificate' and 'Intermediate CA group'.

Part (2) Configure FortiWeb to request the client certificate:

Import the CA Intermediate/root certificate generated from CA that issued the client certificates at Server Objects -> Certificates -> CA.
Apply the imported CA certificate to a CA group at Server Objects -> Certificates -> CA -> CA Group.
Apply the CA group to a Certificate Verify at Server Objects -> Certificates -> Certificate Verify.
Apply the Certificate Verify in the server pool Policy -> Server Policy -> Choose the related policy -> Advanced SSL Settings -> Certificate Verification for HTTPS.