Skip to main content
AlexeyU
AlexeyU
New Member
October 23, 2025
Solved

Fortigate 7.4.8 or 7.6.4 Virtual Server intermediate certificate problem

  • October 23, 2025
  • 3 replies
  • 779 views

Hello All,

 

Have issue on both Fortigate's (v 7.4.8 and 7.6.4). I'm import endpoint certificate via PFX (wildcard). Import two certificates - root and intermediate to "Remote Certificate". If I open info of endpoint certificate and view Serial Numbers of intermediate and ca certificates - its identical for Serial Numbers of imported certificates.

 

But in test via 
openssl s_client -connect mysite:443 -servername mysite -showcerts

 

I'll see error "Verify return code: 21 (unable to verify the first certificate)"

What's wrong, what I missed?

Best answer by funkylicious

hi,

try importing the CA certificate as a Remote CA certificate ( Import CA Certificate ) alone.

in it, under Details you should see something similar with:

X509v3 Basic Constraints CA:TRUE

X509v3 Key Usage Digital Signature, Certificate Sign, CRL Sign

3 replies

AEK
SuperUser
AEK
SuperUser
October 23, 2025

Hi Alexey

When you open the location on the browser of the same client, is it trusted? And do you see the certificate chain when you click view certificate? I guess yes.

On my Linux the openssl command doesn't use the same CA path as the Web browser (I don't know for Windows), so I need to install the CA for system-wide trust in order to be trusted by openssl.

AEK
    AlexeyU
    AlexeyUAuthor
    New Member
    October 23, 2025

    Yes, web site is trusted. All chain is visible and I can view certificates. My colleague said that the problem occurs if the intermediate certificate is not received from the web server. I went to check and found a error..

     

    Another one - I have old Microsoft TMG server and have a published the same web-server with the same public certificate - no error with intermediate certificate via openssl checking.

     

    I conducted all tests on one computer.

    funkylicious
    SuperUser
    funkyliciousAnswer
    SuperUser
    October 23, 2025

    hi,

    try importing the CA certificate as a Remote CA certificate ( Import CA Certificate ) alone.

    in it, under Details you should see something similar with:

    X509v3 Basic Constraints CA:TRUE

    X509v3 Key Usage Digital Signature, Certificate Sign, CRL Sign

    "jack of all trades, master of none"
      AlexeyU
      AlexeyUAuthor
      New Member
      October 24, 2025

      Oh, my fail. I'm load root cert to Remote Certificates, not CA Remote Certificates.

       

      Thanks a lot!

      Terms & ConditionsAccessibility statement