Where to define CA certificate authentication ?

Hi Shantilal1998,

If I understand correctly, you are after SSL VPN ldap/radius auth + certificate as 2fa.
You need to configure a pki user indeed, that's where you define the CA.

SSL VPN ldap auth:
https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/115783/ssl-vpn-with-ldap-user-authentication

PKI user:
https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/776666/creating-a-pki-peer-user

Then you'll have to enable PKI as second factor on SSL vpn auth rules:

config vpn ssl settings
config authentication-rule
edit 12
set groups "PKI_USERS"
set portal "full-access"
set realm "pki"
set client-cert enable
set user-peer "user1"
next

config user peer
edit "user1"
set ca "fortiauth.local.root"
set ldap-server "LDAPS-bogusinc.local"
set ldap-mode principal-name
next

config user group
edit "PKI_USERS"
set member "LDAPS-bogusinc.local"
config match
edit 1
set server-name "LDAPS-bogusinc.local"
set group-name "CN=Users,CN=Builtin,DC=bogusinc,DC=local"
next

SSLVPN-> Settings -> server certificate - this better not be Fortinet_Factory.
Use a certificate issued by a CA you/your users can trust (private or public).

You can grab one for free from Let's Encrypt if you're running at least FOS 7.0:
https://docs.fortinet.com/document/fortigate/7.0.8/administration-guide/822087/acme-certificate-support

Please mark this as resolved if I answered your question.

Hi, 

Actually, It was working fine in version FortiOS 7.0.5 & facing issue after upgrading to 7.2.2.

PKI user & server certificate was not configured but users were able to connect. Why ??

Hi,

We have a existing TAC case for the same and executed the commands as you mentioned. But till now there is no resolution.

Any suggestion would be helpful for us from your side.

Is there anything that we can check on the endpoint system.