ZTNA Access Denied with Forticlient on Fedora

Hi Setphan , 

In Windows, FortiClient automatically installs certificates into the certificate store. The certificate information in the store, such as certificate UID and SN, should match the information on FortiClient EMS and FortiGate.

To locate certificates on endpoint consult the vendor documentation.

The error message you're seeing relates to the ZTNA client certificate. These certificates are crucial for ensuring a secure connection between the client and the server. If the certificate is expired, corrupted, or not trusted, it can lead to such issues.

• Check if the ZTNA client certificate is still valid. Expired certificates will need to be renewed.
• Ensure that the certificate is correctly installed and that the FortiClient software has the necessary permissions to access it.
• Sometimes, it might help to manually import the certificate into the system's trusted certificate store.

Hi@sschuster,

If your FortiClient is connected to EMS, your client device should receive ZTNA client certificate.

On Fedora, you can verify if the certificate is imported into NSS shared DB with the bellow command:

certutil -d sql:$HOME/.pki/nssdb -Ln 'FortiClient ZTNA'

If you don't see any certificate there, maybe check if TPM is enabled in your BIOS (or VM config).

If you you can see the details of the ZTNA certificate, maybe just try closing ALL of your browser windows and then starting them again. Your browsers should prompt you to submit a ZTNA certificate when accessing ZTNA secured website.

If you get stuck, I'd suggest opening a TAC Support ticket.

Hi @sschuster 

Can you please check, if the forticlient learned the tags from EMS that you are trying to access the service or application?

Regards,

Thank you for your Aswers so far.

certutil -d sql:$HOME/.pki/nssdb -Ln 'FortiClient ZTNA'

shows the certificate (but it takes really long time, >10sec?)  and the browsers are showing the popup to select the client cert.
Unfortunately I don't have logs about whats happening during that certificate check.
Fortigate is not logging this in the ZTNA logs, Forticlient seems to log nothing as well and the browser, started in terminal, does not show sothing as well.
The only thing I could find is 

{     "request_time": "Mon Oct  9 13:40:59 2023 CEST",     "receive_time": "Mon Oct  9 13:43:35 2023 CEST",     "request_reason": "client certificate cannot be found on the system",     "cert_serial": "[removed by me]",     "ems_serial": "[removed by me]",     "ems_address": "fct-[removed by me].forticlient-emsproxy.forticloud.com" }

in /var/log/forticlient/ztna-cert.info.

best

stephan

Hi @sschuster 

Can you please give the output of the below command to the user?

diagnose endpoint record list

Is the EMS serial number and client cert matching on the Fortigate and EMS server?

Regards,

Because there are only Widows clients in the Endpoint Record List I focused on trying to find out if there is a general misconfiguration or if it is a Linux/Linux client related issue. I added new Clients. A MacOS client, another Fedora Client and a Ubuntu Client (VM on my machine). It worked immediately for the MacOS Client but for none of the Linux clients. So it must be something related to Linux or the Forticlient on Linux.