FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
FortiOS 7.2.5 and 7.4 are using OpenSSL 3.0, in which x509 certificates signed using SHA1 are no longer allowed at security level 1 (the default level) and above.
The error message from diagnose debug application sslvpn -1 is as follows:
No client certificate
When collecting packets from client machines, the certificate will not be found.
To work around it, under 'vpn ssl settings', apply 'set ssl-min-protocol to tls1-1' to lower the security level to 0. This is strongly discouraged unless strictly necessary.
