New Member

Solved

FortiClient EMS not trusting elaticsearch CA, how to make it trust that certificate?

5 replies
287 views

Hey,

we have FortiClient EMS (Linux) running at version 7.4.5 build2111 (Mature)

And recently we installed a small independent elasticsearch cluster that's only supposed to get the FortiClient Endpoint Events.

The FortiClient EMS Administrator Guide is not helpful at all at explaining how to get EMS to connect to that elasticsearch cluster.

It keeps complaining about the CA certificate:

2026-03-18T15:07:43.445Z ERROR service/event.go:103 create indices: create all indices: check if index forticlientems_alerts_745-write exists: an error happened during the Exists query execution: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA")

I used the emscli to give it the proper parameters including a path to the certificate, imported it to the ubuntu trust store and tried every possible way I can think of but it just keeps complaining.

How can I convince EMS to trust this autogenerated self-signed certificate?

Changing the certificate to another one on the elasticsearch side is not an option either because it would just circle me back to the same problem of how to make EMS trust that CA / the certificate as we dont have any publicly signed CA certs for our internal domain that we are using.

FortiClient EMS

soh-ofAnswer

New Member

it works now.

The solution is as simple as it is kind of bothering me.

Instead of following the administrator guide or interactive command help and giving the emscli command the ca cert which was used to sign the elasticsearch node certificates I gave it the certificate of the first elasticsearch cluster node.

And now it works.

funkylicious

SuperUser

is the selfsigned ES cert available for forticlientems user to read ?

L.E. try copying it to /opt/forticlientems/data/certs and running the emscli command again for the elastic_ca_path with this location

"jack of all trades, master of none"

soh-ofAuthor

New Member

hey

thank you for the suggestion.

I copied it there, changed the owner to forticlientems:forticlientems and gave it chmod 777 just to test it then issued the emscli command with the new ca path. Outcome is still the same

funkylicious

SuperUser

from your first post i understand that EMS was already installed and then you deployed a ES instance which needs to be integrated with, meaning you are in this scenario - https://docs.fortinet.com/document/forticlient/7.4.5/ems-administration-guide/516708/enabling-es-integration-after-ems-install

If the ES cluster is set up to strictly check for a client certificate, you must provide the CA certificate to EMS. This must be a fully qualified path to the CA certificate file. Store the file in a location outside of /opt/forticlientems and be readable by the forticlientems user or group. For example, you may configure the following:  --es.cert=/data/certs/es_ca.crt

can you post more info about the error message that you are getting ? have you also tried a restart for the EMS services ? emscli service restart --all

"jack of all trades, master of none"

soh-ofAuthorAnswer

New Member

it works now.

The solution is as simple as it is kind of bothering me.

Instead of following the administrator guide or interactive command help and giving the emscli command the ca cert which was used to sign the elasticsearch node certificates I gave it the certificate of the first elasticsearch cluster node.

And now it works.

Sign up

Login with SSO

Login to the community

Login with SSO