Skip to main content
Magion
Magion
New Member
April 2, 2020
Solved

(Computer) client certificate validation

  • April 2, 2020
  • 2 replies
  • 53734 views

Hi,

 

I have a working SSLVPN solution where I use client validation to check for a computer certificate from our internal PKI on the client. Domain computers get a certificate using autoenrollment policies and the root certificate is stored on the Fortigate. By enabling users to select the computer certificate in FortiClient during login, they can select the right certificate, which can be validated by Fortigate. So far so good...

 

The problem is, any certificate/key pair on the client, with a matching root on the Fortigate passes certificate validation. Since we use Lets Encrypt certificates, I uploaded the root of LE onto the Fortigate. If I install any valid LE certificate on the client, this certificate is also accepted.

 

Fortigate accepts any valid certificate for which it has a root certificate installed.

 

Is there a way to limit validation to specific root certificate(s)? Or perhaps check on specific certificate details?

 

 

Using only Fortigate, no other Fortinet products.

User authentication is done entirely on a remote Radius server, so no local/ldap/radius users defined.

FortiOS 6.0.5, FortiClient 6.0.8

 

Thx,

Michel

Best answer by Magion

Just got word from support again. The gave me this link: https://kb.fortinet.com/kb/documentLink.do?externalID=FD47120.

 

Although I find the example config a bit confusing, it seems like what I want to accomplish might be possible... but only from FortiOS 6.2.2+. We are still on 6.0.5.

 

2 replies

boneyard
boneyard
Valued Contributor
April 5, 2020

I don't believe this will be an issue. Most public CAs don't sell client certificates, so there is no issue there.

Magion
MagionAuthor
New Member
April 6, 2020

It is, and yes they do.

 

I use the client certificate check to make sure only company owned machines can connect to the vpn. For that I need to be sure only specific certificates (from our own private pki) are accepted. FGT however seems to allow any valid certificate. If I install a LE certificate, I can use it to pass client certificate check. Which means I cannot depend on this test anymore, unless I can specify a root ca.

 

As for client certificates, I think most major CA's sell them. But even regular 'web' certificates can be used as client certificate. I have checked my old certificates, and so far ALL server certificates contained both server authentication and client authentication EKU's.

 

 

Magion
MagionAuthor
New Member
April 15, 2020

Well, unfortunately Fortinet support could not help as well. They keep telling me to create peer users... But since I use an external radius server for authentication, no users management is done on the firewall.

 

I created a firewall group and added the radius server as remote group. Now, if I add a peer user with a root ca defined, would it then 'combine' the 2. So use authentication from the remote group radius and use the root ca for the certificate check?

 

(Can I change this with out having all vpn sessions killed? Some changes to vpn or certificate settings usually end all vpn sessions )

 

I was hoping for something easy like:

 

config vpn ssl settings set reqclientcert enable set ca 'my root ca' end

 

 

Agent_1994
Agent_1994
New Member
April 17, 2020

Magion,

 

 I had a similar problem days ago, but with an internal CA. I wanted to use computer certificates but not user certificates. 

 First, the user have to be administrator or at least have permissions to access the computer certificate private key. If not, the certificate will be available in FortiClient but wont work.

 Second, in user->pki I used subject filterning to match part of the FQDN. I.E.: my lab environment had hydra.local as the domain, so the subject filter was ".hydra.local" (note the dot at the start, it will match computer.hydra.local but not user@hydra.local).

 That being said: if your certificates have something in common -or could have-, you can use subject filtering. 

 

Max

Magion
MagionAuthor
New Member
April 20, 2020

emnoc wrote:
OP can you post your config and th "config user peer" ?

 

No, because I don't have any users defined on the firewall. No regular, no peer. So I can't show you anything

Just as Kojot, I only have "require user certificate" set.

 

mkolus wrote:
First, the user have to be administrator or at least have permissions to access the computer certificate private key. If not, the certificate will be available in FortiClient but wont work.

 

This is what I found: https://kb.fortinet.com/k....do?externalID=FD47826

I did not change anything for #1. ACL is set to only system and administrators to access the private key. I have allow_standard_user_use_system_cert set in the client config according to #3.

 

Then at #2 it says that if the certificate is visible in the selection box (which it is), all should be well...

 

 

Terms & ConditionsAccessibility statement