Description
This article outlines the process of updating certificates for SAML authentication, focusing on the expiration or upcoming expiration of the IDP certificate.
Scope
FortiAuthenticator, FortiGate.
Solution
FortiAuthenticator is the Identity Provider and FortiGate is the Service Provider.
On FortiAuthenticator:
- The new certificate must be imported under Certificate Management -> End entities -> Local services.
- Add the new certificate on the SAML IDP settings of SAML server. Navigate to Authentication -> Remote Auth Servers -> SAML server.
On FortiGate:
- Update the IDP certificate. Navigate to Create/Import Remote Certificate and import the IDP certificate.
- Navigate to Single Sign-on and update the certificate in the Identity Provider configuration section.
Note the renewed certificates for the SAML authentication are now updated on both FortiAuthenticator and FortiGate.
If SAML is used for admin/self-service portal/captive portal login, the certificate needs to be updated on FortiAuthenticator.
Navigate to System -> Administration and add the updated certificate.
Verification and Common Issues:
Perform verification steps to ensure that the right Certificate is uploaded and the certificate is validated by right Certificate Authority.
Note that the Certificate should always match with the following details:
- Serial number.
- Common Name (CN).
- Validity Period.
These steps assume that the CA is the FortiAuthenticator and the certificate was renewed by generating the certificate on FortiAuthenticator, or if the CA is a 3rd Party CA and a Certificate was generated from the 3rd Party CA.
The Root Certificate authorityKeyIdentifier is same as the Certificate Created authorityKeyIdentifier using the Root CA.
For example:
Root authorityKeyIdentifier
keyid: x.x.x.....................:10:70:DD
Created Certificate authorityKeyIdentifier
keyid: x.x.x.....................:10:70:DD
Issue 1:
If the Certificate is signed by a 3rd party CA and the Common Name is missed and SAN (Subject Alternative Name) is used instead, the following error appears:
Error: ""The certificate is invalid (missing CN)""
The Common Name Field is mandatory for the certificate to either be created or uploaded to the FortiAuthenticator.
If the Certificate is signed by the CA on the FortiAuthenticator, the certificate cannot be created without a Common Name.
Issue 2:
Untrusted Certificate message during FortiTokenMobile communication with FortiAuthenticator.
