FortiNAC self signed certificate

Forum|Forum|3 months ago
May 3, 2026
5 replies
86 views

Hello everyone,

I would like to know, will I have issues with the persistent agent if I use Fortinac’s Self signed certificate ?

BR,

Best answer by AEK

Hi BH

Self-signed will not be trusted by the client, unless the client has the cert of the CA that signed the certificate.

So unless FortiNAC agent already imports the CA cert of NAC server on the host (which cannot be confirmed from my side), the connection between NAC client and NAC server will not be established, and you will see the NAC client always down (red bolt icon).

The solution is to always sign the CSR with a CA that is trusted by the clients, like your windows domain CA.

AEKAnswer

SuperUser

Hi BH

Self-signed will not be trusted by the client, unless the client has the cert of the CA that signed the certificate.

So unless FortiNAC agent already imports the CA cert of NAC server on the host (which cannot be confirmed from my side), the connection between NAC client and NAC server will not be established, and you will see the NAC client always down (red bolt icon).

The solution is to always sign the CSR with a CA that is trusted by the clients, like your windows domain CA.

AEK

ebilcari

Staff

The Agent does not automatically trust or import the certificate from FNAC. While the Agent certificate can technically be exported from FNAC and manually imported on the end hosts, this is not recommended. More details can be found in this guide: Installing SSL Certificates.

Emirjon

ByteHavenAuthor

Explorer III

I know it isn’t recommended, but when trying to export the created self signed certificate on FNAC, i get this error “cannot create export files without a valid certificate”.

I’ve seen this article, but it doesn’t work in my case, any tips please ?

Sign up

Login with SSO

Login to the community

Login with SSO