|
A new feature and a CLI toggle of 'set trust-ca-cn' was added in 7.2.4 firmware to address the issue of automatic certificate renewal that happens on the FortiClient EMS cloud every 3 months.
Because of this renewal, the connection between FortiGate and to EMS cloud is interrupted when renewal.
This enhancement adds a new CLI option for each FortiClient EMS connector (trust-ca-cn). This option is enabled by default. When enabled, the Certificate Authority (CA) & Common Name (CN) information is stored with the connector, which allows the FortiGate to automatically approve an updated certificate so long as it has the same CA & CN.
For some CA with special characters in the CA name, this does not work as the secondary unit of the FortiGate HA cluster does not sync the CA name and throws an 'XSS vulnerability characters' error.
Example:
Non-working Scenario when the CA has a \' in its name.
FGVM04TM22-----2 # config endpoint-control item
FGVM04TM220-----2 (fctems) # edit 1
FGVM04TM22-----2 (1) # show
config endpoint-control fctems
edit 1
set status enable
set name "ems"
set server "10.0.10.200"
set https-port 10443
set serial-number "FCTEMS8822-----0"
set tenant-id "00000000000000000000000000000000"
set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api tenant-id
set ca-cn-info "C = US, O = Let\'s Encrypt, CN = R3*.yvrlab.us"
The string contains XSS vulnerability characters
value parse error before 'C = US, O = Let'
Command fail. Return code -173
In Working Scenario, when the special characters are removed from the CA name, it works.
# config endpoint-control fctems
edit 1
set status enable
set name "ems"
set server "10.0.10.200"
set https-port 10443
set serial-number "FCTEMS8822-----0"
set tenant-id "00000000000000000000000000000000"
set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api tenant-id
set ca-cn-info "C = US, O = Lets Encrypt, CN = R3*.yvrlab.us"
next
To disable "set trust-ca-cn", "config endpoint-control fctems" in firmware 7.2.4 GA
Example:
# config endpoint-control fctems
edit 1
set trust-ca-cn disable
end
The issue is addressed and resolved in Firmware 7.2.5 and 7.4.0.
|
