OCSP Server Not Contacted by FortiGate

Forum|Forum|10 years ago
July 26, 2016
7 replies
11643 views

Hi,

I have a FortiGate 80D on v5.2.8 and FortiAuthenticator (trial) on v4.1.1 (v4.00-build0081).

I have a local user on the FAC and is authenticated via RADIUS from the FortiGate - that's working.

I set up CA, SCEP, Device Certificate Enrollment, User self-registration etc. and everything is working.

Now I want to use online certificate revocation checking - according to FAC document it should be done via SCEP on port 2560.

The settings on the FortiGate:

# show vpn certificate ocsp-server config vpn certificate ocsp-server edit "fac_ocsp" set url "http://192.168.231.3:2560" set cert "REMOTE_Cert_1" next end

When I connect with the FortiClient using username/password and certificate the CRL via SCEP is not checked. I cannot see any communication from the FortiGate to FortiAuthenticator on port 2560.

When I try telnet from FortiGate it seems to be working:

# execute telnet 192.168.231.3 2560 Trying 192.168.231.3... Connected to 192.168.231.3. HTTP/1.0 200 OK Content-Type: application/ocsp-response Content-Transfer-Encoding: Binary Content-Length: 5 Date: Jul 26 13:54:03 2016 GMT Expires: Jul 26 13:59:03 2016 GMT 0 Connection closed by foreign host.

Why the FortiGate is not checking the revocation status? Some other configuration is needed or is it a bug?

Jeff_FTNT

Staff

Please check setting :

config vpn certificate setting set ocsp-status disable set ocsp-default-server '' set check-ca-cert enable set strict-crl-check disable set strict-ocsp-check disable end

AtiTAuthor

New Member

Hello Jeff,

Thank you for these settings I missed them.

I set the following:

# show vpn certificate setting config vpn certificate setting set ocsp-status enable set ocsp-default-server "fac_ocsp" set strict-crl-check enable set strict-ocsp-check enable end

However the FGT is still not contacted the FAC for CRL. Also the fnband debug does not show the CRL checking:

# diagnose debug application fnbamd -1 # diagnose debug enable fnbamd_fsm.c[2146] handle_req-Rcvd auth_cert req id=226456370 fnbamd_auth.c[1308] check_cert-CA found: CA_Cert_5

------ here should be the CRL check status ------------ fnbamd_auth.c[1608] cert_check_group_list-group list is null fnbamd_comm.c[169] fnbamd_comm_send_result-Sending result 0 for req 226456370 fnbamd_fsm.c[1891] handle_req-Rcvd auth req 226456371 for ta in RadiusGroup opt=00000100 prot=10 fnbamd_fsm.c[336] __compose_group_list_from_req-Group 'RadiusGroup'

When I import the CRL manually into the FGT the CRL is checked:

fnbamd_fsm.c[2146] handle_req-Rcvd auth_cert req id=226456316 fnbamd_auth.c[1308] check_cert-CA found: CA_Cert_5 fnbamd_auth.c[1688] check_crl-CRL found: CRL_2 fnbamd_auth.c[1608] cert_check_group_list-group list is null fnbamd_comm.c[169] fnbamd_comm_send_result-Sending result 0 for req 226456316 fnbamd_fsm.c[1891] handle_req-Rcvd auth req 226456317 for attilatoth in RadiusGroup opt=00000100 prot=10 fnbamd_fsm.c[336] __compose_group_list_from_req-Group 'RadiusGroup'

Should I open a support ticket for this?