Forticlient vpn cannot connect to server, SSL error
Hi
I'm having trouble connecting to the server of one of our customers. In the last 2 weeks it worked but now all I'm getting is
Status: Disconnected
Notification: Error: Can not connect to VPN server.
I'm using the Foriclient (VPN only client) 7.4.3.1736 für AMD64 linux on a freshly updated Debian 13.
In 3 of 5 cases, I enter the password and immediately get this error messages. And even when it manages to connect to the server, it prompts me for the token. And the generated token does not work anymore (using latest FortiToken Mobile on android).
This is the error message that I see in /var/log/forticlient/sslvpn.log
20260218 00:15:24.439 TZ=+0100 [sslvpn:DEBG] vpn_connection:446 https server '<REDACTED>' has this certificate, which looks good to me:
/CN=<REDACTED>
20260218 00:15:24.462 TZ=+0100 [sslvpn:DEBG] vpn_connection:669 http connection closed.
20260218 00:15:24.463 TZ=+0100 [sslvpn:DEBG] vpn_connection:531 Response line: 200 OK
20260218 00:15:24.464 TZ=+0100 [sslvpn:DEBG] sslvpn:236 /remote/logincheck POST data is encoded in MD5
20260218 00:15:24.464 TZ=+0100 [sslvpn:INFO] vpn_connection:2447 /remote/logincheck
20260218 00:15:24.535 TZ=+0100 [sslvpn:DEBG] vpn_connection:446 https server '<REDACTED>' has this certificate, which looks good to me:
/CN=<REDACTES>
20260218 00:15:24.535 TZ=+0100 [sslvpn:DEBG] vpn_connection:664 http request error: 1
20260218 00:15:24.535 TZ=+0100 [sslvpn:EROR] vpn_connection:610 error:1C880004:Provider routines::RSA lib
20260218 00:15:24.535 TZ=+0100 [sslvpn:EROR] vpn_connection:610 error:02000085:rsa routines::first octet invalid
20260218 00:15:24.535 TZ=+0100 [sslvpn:EROR] vpn_connection:610 error:00000001:lib(0)::reason(1)
20260218 00:15:24.535 TZ=+0100 [sslvpn:EROR] vpn_connection:2274 Error: Can not connect to VPN server.
20260218 00:15:24.537 TZ=+0100 [sslvpn:INFO] nettools:1854 More than one device with index 2 can be found
20260218 00:15:24.537 TZ=+0100 [sslvpn:INFO] nettools:1854 Device address details: local_address 192.168.15.24, device_index 2, device name eth0 (read from netlink)
20260218 00:15:24.537 TZ=+0100 [sslvpn:INFO] nettools:1854 Device address details: local_address fe80::bbb1:ca94:7574:b634, device_index 2, device name eth0 (read from netlink)
The interesting part is the SSL errors. I don't really know what that means or how I can solve that.
In the rare occasions when I'm able to connect to the the server, it asks for thee token but it doesn't work either:
20260218 00:33:57.416 TZ=+0100 [sslvpn:DEBG] main:2091 Received user input
20260218 00:33:57.416 TZ=+0100 [sslvpn:DEBG] main:201 get passwd: false, get cert passwd: false, get user input: true
20260218 00:33:57.429 TZ=+0100 [sslvpn:DEBG] main:282 78 bytes sent.
20260218 00:33:57.477 TZ=+0100 [sslvpn:INFO] main:169 Received credentials using fallback method.
20260218 00:33:57.477 TZ=+0100 [sslvpn:DEBG] main:2091 Received user input
20260218 00:33:57.477 TZ=+0100 [sslvpn:EROR] main:2106 Wrong format
20260218 00:33:57.477 TZ=+0100 [sslvpn:DEBG] vpn_connection:2324 Unexpected user input received: [7]
The generated token are 6 numbers. Yes, I might get a typo one in a while, but 10 times in a row? Why is the client complaining about a wrong format for a 6 digit code?
Just out of curiosity I tried the Windows client instead. Here I had similar problems, I got a few "cannot connect" messages before prompting for the token. But at least the token worked, so my FortiToken Mobile is not the problem.
Has anybody have an idea what is going on? Is this even an issue on my side or is it an issues on the server side?
Thanks.
