Skip to main content
HeretoLearn23
New Member
November 12, 2025
Question

LDAPS and Forti products

  • November 12, 2025
  • 2 replies
  • 291 views

So I enabled LDAPS on Fortigate, FortiADC, FortiVoice, Fortianalyzer and did NOT upload the RootCA to any of them and LDAP is still working. 

 

For Fortianalyzer I enabled Debugging. So not sure if a cert is required on the fori side of things? 

 

This is what I get with no CERT applied 

2025-11-12 13:16:16 s121: auth request: user= from=GUI
2025-11-12 13:16:16 s121: found admin:
2025-11-12 13:16:16 s121: start ldap: LDAP
2025-11-12 13:16:16 s121:LDAP: connecting to server 0: IPhere ip= port=636/tcp
2025-11-12 13:16:16 s121:LDAP: connected
2025-11-12 13:16:16 s121:LDAP: url: ldaps://IPhere:636
2025-11-12 13:16:16 s121:LDAP: starting tls: ca=
2025-11-12 13:16:16 s121:LDAP: binding admin: FortiSA
2025-11-12 13:16:16 s121:LDAP: got result: Success(0)

 

And here is what I get when a CERT is applied. 

2025-11-12 13:16:16 s121: auth request: user= from=GUI
2025-11-12 13:16:16 s121: found admin:
2025-11-12 13:16:16 s121: start ldap: LDAP
2025-11-12 13:16:16 s121:LDAP: connecting to server 0: HOSTNAMEHERE ip= port=636/tcp
2025-11-12 13:16:16 s121:LDAP: connected
2025-11-12 13:16:16 s121:LDAP: url: ldaps://HOSTNAME:636
2025-11-12 13:16:16 s121:LDAP: starting tls: ca=Root
2025-11-12 13:16:16 s121:LDAP: binding admin: FortiSA
2025-11-12 13:16:16 s121:LDAP: got result: Success(0)

2 replies

AEK
SuperUser
SuperUser
November 13, 2025

If I'm not wrong this requirement is mandatory starting from some late versions.

Which versions of FortiProducts are you using?

AEK
HeretoLearn23
New Member
November 13, 2025

Fortigates  7.2.11

Analyzer 7.4.7

ADC 7.4.7

 

AEK
SuperUser
SuperUser
November 13, 2025

On FGT it is enforced starting from versions 7.4.4.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-STARTTLS-certificate-issuer-enforcement/ta-p/316854

On FAZ/FMG/ADC need to search in some release notes.

AEK