Need Sample Config – FortiGate NAC Lite + FortiAuthenticator + Intune (EAP-TLS)

I think the tag that is used is not the right one, this integration is not related to FortiNAC (as a product) but related to FortiGate and FortiAuthenticator.

Hi,

from the description I have to assume, you have Intune as SCEP client, FortiAuthenticator as SCEP server.
SCEP is an HTTP based protocol, so HTTP logic applies (with its response codes).

First, see to reproduce an SCEP request at will and then check the logs at that time when you reproduced the issue. The logs that you shared from FortiAuthenticator are not relevant because it says that the client didn't specify which CA to return, so FortiAuthenticator returned the default one.

Your client logs say that FortiAuthenticator responded with an HTTP code 404, which is that the resource cannot be found because the requested resource does not exist. As the 404 and the FortiAuthenticator log do not match, check what the client is requesting that FortiAuthenticator answers with 404.

I don't see this as related, the CA certificate message will not return a 404 but a HTTP 200 with the CA certificate that is sent to the client.

FortiAuthenticator listens at /app/cert/scep/.

The client should make a GetCACaps request, gets a response.
Client makes a CA request, gets a response (which you log says is happening).
Client should then ask to have a certificate signed (that log will be interesting)

Your "Failed to retrieve requested CA" proves that it answers on it the link and the GetCACaps seems OK. After this, the client is supposed to make a certificate request to the FortiAuthenticator which in turn should be visible in packet capture and logs.
Debug logs can of course help and are found at https://fac-ip/debug/scepd

I don't have a sample config for Intune, but for FortiAuthenticator and certmonger:
https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Example-of-use-of-certmonger-and/ta-p/355014
In the link you can see debugs, that show the same error message you posted, but it has no relation to the function as the default CA is good.

Tip:

On FortiAuthenticator create a wildcard enrollment for test with no subject matching, to avoid issues with that for now. Add these when the rest of enrollment is working with the wildcard.

Quick guess, ignoring the 404. The SCEP client must trust the CA and needs to have its public CA installed in its trust store. You may have then issues in the Intune log about untrusted certificate as a result of the CA certificate that is returned.

Best regards,

Markus