FortiToken Mobile 6.5.0.0030 on Android 16 - activation fails because globalftm.fortinet.net certificate chain is no longer trusted

Hi,
I am experiencing a FortiToken Mobile activation failure on Android 16 with FortiToken Mobile 6.5.0.0030.

The error shown during activation is: "Invalid server certificate - FortiToken Mobile cannot validate the server certificate."

I found an older Fortinet Community discussion describing a very similar problem after upgrading to Android 13:

FortiToken Mobile cert error on Android 13
https://community.fortinet.com/support-forum-92/fortitoken-mobile-cert-error-on-android-13-115185

In that thread, the original poster later reported: "Fortinet support said this is bug 765700."

Fortinet also documented bug 765700 in the FortiToken Mobile Android 5.2.3 release notes:

FTM Android 5.2.3 Known issues
https://docs.fortinet.com/document/fortitoken/5.2.3/ftm-android-5-2-3-release-notes/999611/known-issues

Bug 765700 is described there as: "'Untrusted Certificate' popup throws when activating/completing token transferring or approving/denying Login Requests"

Fortinet later listed bug 765700 in the FTM Android 5.3.2 resolved issues:

FTM Android 5.3.2 Resolved issues
https://docs.fortinet.com/document/fortitoken/5.3.2/ftm-android-5-3-2-release-notes/666021/resolved-issues

The description says that part of the Untrusted Certificate issue was fixed.

Interestingly, bug 765700 was still listed as a known issue in FTM Android 5.3.3, specifically mentioning an Untrusted Server Certificate during FortiToken activation:

FTM Android 5.3.3 Known issues
https://docs.fortinet.com/document/fortitoken/5.3.3/ftm-android-5-3-3-release-notes/999611/known-issues

There is also a Fortinet troubleshooting article for the exact error message:

Troubleshooting Tip: Invalid server certificate - FortiToken Mobile cannot validate the server certificate
https://community.fortinet.com/fortiauthenticator-8/troubleshooting-tip-invalid-server-certificate-fortitoken-mobile-cannot-validate-the-server-certificate-101390

My current case is different enough that I cannot confirm whether this is a regression of bug 765700 or a separate issue.

The same FortiToken activation code works successfully with FortiToken for Windows. This indicates that the token itself and the Fortinet provisioning service are functional.

I investigated the Android failure further.

FortiToken Mobile 6.5.0.0030 sends the initial SoftToken.MobileProvisionRequest to: https://globalftm.fortinet.net/SoftToken/Provisioning.asmx/Mobile

During initial provisioning, the application first uses its check_system_certs TLS validation path. If certificate validation fails, the request ends with SSLHandshakeException and the application displays the certificate error dialog.

I also checked the application's Android Network Security Configuration. FortiToken Mobile 6.5.0.0030 targets API 35 and trusts several bundled Fortinet certificates plus: <certificates src="system"/> It does not include: <certificates src="user"/>

globalftm.fortinet.net currently presents this certificate chain: globalftm.fortinet.net-> DigiCert SHA2 Extended Validation Server CA-> DigiCert High Assurance EV Root CA

The leaf certificate is currently valid from 8 April 2026 until 23 October 2026.

On my Android 16 device, DigiCert High Assurance EV Root CA is no longer present in the active Conscrypt APEX trust store: /apex/com.android.conscrypt/cacerts

The old certificate is still present under: /system/etc/security/cacerts but it is absent from the active APEX CA set.

To verify this independently of the FortiToken application, I extracted all 120 certificates from the device's Conscrypt APEX trust store and used them as the only CA bundle with OpenSSL.

Validation of globalftm.fortinet.net fails:

depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify error:num=19:self-signed certificate in certificate chain
Verification error: self-signed certificate in certificate chain
Verify return code: 19 (self-signed certificate in certificate chain)

As an A/B test, I used exactly the same Android CA bundle against: ftc.fortinet.com:8688

That endpoint validates successfully:

depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
Verification: OK
Verify return code: 0 (ok)

This strongly suggests that the problem is specifically related to the certificate hierarchy currently used by globalftm.fortinet.net.

Another relevant observation is that changing FortiToken Mobile's "Allow connection to an unverified server" setting does not solve initial token activation.

From the application flow, this option is used by other operations such as push authentication and token transfer. The initial provisioning flow, however, simply displays the certificate error after the SSLHandshakeException and terminates the activation attempt.

Installing the legacy DigiCert root as an Android user CA also does not appear to be a valid workaround because FortiToken Mobile's Network Security Configuration trusts system certificates but does not include user certificates.

Could Fortinet please confirm:

1. Is globalftm.fortinet.net expected to still use the DigiCert High Assurance EV Root CA hierarchy in September 2026?
2. Is this related to bug 765700, a regression of that issue, or a new FortiToken Mobile issue?
3. Is there any supported workaround for Android devices whose current system trust store no longer contains this DigiCert root?
4. Is the certificate for globalftm.fortinet.net planned to be reissued under a currently trusted DigiCert hierarchy?

For the moment I have switched the affected FortiGate administrator to email OTP as a workaround.

Thanks.

Daniel Vedovato