The certificate communication flow is like this:
When a wildcard certificate is used for the FortiNAC Persistent Agent (PA) service, proper certificate deployment and trust-chain validation are required to establish secure communication between the Persistent Agent and the FortiNAC server.
1. On FortiNAC side as Service provider for PA
The wildcard certificate assigned to the Persistent Agent service must be installed on the FortiNAC Persistent Agent Certificate Target. The complete certificate chain should be uploaded, including:
The wildcard server certificate.
Any Intermediate CA certificate(s).
The corresponding private key.
This allows the FortiNAC Persistent Agent service running on TCP port 4568 to present a valid certificate chain to connecting clients.
2. On Persistent Agent Clients
Each endpoint running the Persistent Agent must trust the Certificate Authority (CA) that issued the wildcard certificate. This typically means that:
The Root CA certificate must exist in the client's Trusted Root Certification Authorities store.
Any required Intermediate CA certificates must also be available to complete the trust chain.
Without a trusted Root CA, the client cannot validate the server certificate and the TLS handshake will fail.
3. Certificate Validation Process
When the Persistent Agent starts communication with FortiNAC:
The client connects to the FortiNAC Fully Qualified Domain Name (FQDN) on port 4568.
The FortiNAC Persistent Agent service presents its configured wildcard certificate and certificate chain.
The Persistent Agent validates:
- The certificate is issued for the requested hostname.
- The certificate is within its validity period.
- The certificate chain can be traced back to a trusted Root CA.
- The certificate has not been revoked and uses an acceptable signature algorithm.
If validation succeeds, the TLS handshake is completed successfully.
A secure, encrypted communication channel is established between the Persistent Agent and FortiNAC.
