Fortigate not allowing SSL VPN with new Certificate Authority

Hello Manuel,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

Hello Manuel,

I have found this document:

https://docs.fortinet.com/document/fortigate/6.2.11/cookbook/266506/ssl-vpn-with-certificate-authentication

Could you please tell me if it helped?

Regards,

Hi Manuel,

you will need to see whether the certificates are installed where they belong. There will be one node sending a certificate, the other will have to verify it. Verification is done with the CA cert. If there is an intermediate CA cert, this is to be included.

Making a guess on your configuration, standard SSLVPN: The client is only receiving a server certificate (FortiGate has this newly issued Server certificate by your new CA set in the SSLVPN settings), The client requires having the root CA installed. Do make sure you have a new server certificate issued by your new CA. The old certificate cannot be used anymore as the certificate chain verification will not work out.

If there is an intermediate CA, make sure this is ALSO installed in the FortiGate.

To install the rootCA in this mentioned case on the FortiGate is not required.

If your FortiGate has the option set of requiring a client certificate, then additionally to the process above, the client will send a client certificate to the FortiGate which then also needs to verify it and have the rootCA installed and the intermediate, if any.

More about certificates:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-TLS-and-the-use-of-Digital-Certificates/ta-p/214958

Best regards,

Markus