- Android is very particular about the server being configured properly with the FULL certificate chain and ALL intermediate certificates, more so than other platforms.
- Android devices do not have ALL intermediate certificates and a FULL certificate chain cannot be formed, hence the 'invalid certificate' message.
- Android platform itself requires a full certificate chain for a portal/FQDN to be considered as trusted.
To verify, use OpenSSL to query FQDN and the port. For example, fortigate.company.com.au:11443:
$ openssl s_client -showcerts -connect fortigate.company.com.au:11443
CONNECTED(000001C0)
depth=0 CN = fortigate.company.com.au
verify error:num=20:unable to get local issuer certificate <---------
verify return:1
depth=0 CN = fortigate.company.com.au
verify error:num=21:unable to verify the first certificate <---------
verify return:1
depth=0 CN = fortigate.company.com.au
verify return:1
If a FQDN has a valid FULL certificate chain:
$ openssl s_client -showcerts random.contoso.com.au:443
CONNECTED(000001B8)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust TLS RSA CA G1
verify return:1
depth=0 C = AU, ST = Victoria, L = Port Melbourne, O = Random-company, CN = random.contoso.com.au
verify return:1
Other websites commonly known as SSL checkers, can be used to validate the certificate chain. These tools can help ensure that the full certificate chain is being sent and properly configured.
Example output when a FQDN does not have a FULL certificate chain:
In conclusion:
- If an FQDN does not have a full certificate chain, this behavior is expected in the Android platform.
- It is not possible to bypass the warning prompt in telemetry if the FortiClient EMS certificate does not have a FULL certificate chain. Android devices must select 'ALLOW' to join to EMS.
- To bypass the warning prompt in the VPN, turn off the 'Enable Invalid Server Certificate Warning' in the Remote Access profile for Android devices.
Related articles:
Troubleshooting Tip: FortiClient error:' The security certificate for this site has been revoked. Th...
Technical Tip: FortiGate Resource Lists
|
