Skip to main content
John_Winfield
John_Winfield
New Member
November 8, 2025
Question

Dialup IPsec VPN with PSK, wish to change to CBA Authentication - Which type of Certificate?

  • November 8, 2025
  • 1 reply
  • 220 views

I’m currently using a dialup IPsec VPN with Entra ID MFA.  The FortiGate is connected to Entra ID using SAML.

 

My questions are:

 

Is this basic SSL certificate the proper type?

 

https://www.ssl.com/certificates/basicssl/

 

Do I need to purchase a certificate for each user?

 

Any comments would be greatly appreciated.

 

Thank you

 

 

1 reply

funkylicious
SuperUser
funkylicious
SuperUser
November 8, 2025

hi,

you can use a single certificate for all users, it can be an external one ( havent tried it tho, but should work ) or could a internal CA signed one.

there is also the posibility of each user/computer having their own certificate, but this is most commonly used in enterprises where its issued/signed by the internal CA and make use of GPO for this.

"jack of all trades, master of none"
Terms & ConditionsAccessibility statement