Technical Tip: Configuring SSL VPN client certificate authentication to a user/group only

[sakuraju]

Description	This article describes how to enable SSL VPN client certificate authentication only for a specific user/group.
Scope	FortiGate.
Solution	Disable 'require client certificate' globally:   Enable client-cert under the authentication rule of SSL VPN settings (this option is available via CLI only): config vpn ssl settings     config authentication-rule         edit <no>   <----- User group that should connect with LDAP client certificate authentication.             set client-cert en <----- Default is disabled.         next  end Note: If the users are using certificate authentication in web mode and 'require client certificate' is disabled globally, then it does not work. To work in web mode, 'require client certificate' should be enabled. Related document: Configuring the SSL VPN settings to require a client certificate