Troubleshooting Tip: FortiClient mobile is unable to proceed with SAML VPN login: 'This Connection is Not Private' message

[btan]

Description	This article describes how to resolve the issue when FortiClient mobile is unable to proceed with SAML VPN login: 'This Connection is Not Private' message.
Scope	FortiClient iOS v7.4.x, FortiClient Android v7.4.x.
Solution	When attempting to connect to a SAML VPN (both SSL VPN and IPsec VPN), FortiClient may redirect to the SAML login page. If the SSO login URL is an IP (not FQDN), users may receive a message 'This Connection is Not Private': This error message is expected, as a site can never be verified with the SSL certificate when it is visited with an IP address. Users can always select 'visit this website' to continue with the SAML login process. However, in certain cases, this 'visit this website' button may not appear; this is because there is HTTP Strict Transport Security (HSTS) being implemented in the environment. HSTS will disregard any attempts to load a web page over HTTP and send the information directly to the assigned HTTPS site. Further reading on HSTS in this document: What Is HyperText Transfer Protocol Secure (HTTPS)?. This could be implemented in the remote server, local network, or even on the device-level. Solution: On the remote FortiGate acting as the VPN server, check the user's SAML configuration: config user saml     edit "azure"         set cert "Fortinet_Factory" <-----         set entity-id "https://61.14.123.132:443/remote/saml/metadata”  <------         set single-sign-on-url "https://61.14.123.132:443/remote/saml/login"  <------         set single-logout-url "https://61.14.123.132:443/remote/saml/logout"  <------         set idp-entity-id "<Microsoft Entra ID identifier>"         set idp-single-sign-on-url "<Azure login URL>"         set idp-single-logout-url "<Azure logout URL>"         set idp-cert "<Base64 SAML certificate name>"         set user-name "username”         set group-name "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"     next end Firstly, the certificate must be a valid SSL certificate: config user saml     edit "azure"         set cert "abc-company-cert" <------------- Use a valid SSL certificate. Next, replace entity-id, single-sign-on-url, and single-logout-url with FQDN. config user saml     edit "azure"         set cert "Fortinet_Factory"         set entity-id "https://samlvpn.company-name.com:443/remote/saml/metadata”         set single-sign-on-url "https://samlvpn.company-name.com:443/remote/saml/login"         set single-logout-url "https://samlvpn.company-name.com:443/remote/saml/logout" After saving the configuration, attempt VPN login with FortiClient mobile. 'This Connection is Not Private' message will no longer appear, and users can proceed with the SAML login process to connect to VPN.