Technical Tip: How to determine if the FortiGate is sending the full certificate chain for the Web UI or SSL VPN

[johnathan]

Description	This article describes how to confirm if FortiGate is sending the full certificate chain for services hosted by the firewall.
Scope	FortiOS 7.x.x+.
Solution	For compliance reasons, sometimes it is required to have a full certificate chain presented when accessing a service hosted by the firewall. Checking this is usually done by using a third-party online tool, but this would not work if testing it locally or on a port different than 443 (common for SSL VPN). It is possible to use 'openssl' for this purpose, which is an open source utility available for Windows and Linux. Compiled binaries for Windows are available here: Open SSL. The command would be 'openssl s_client -showcerts x.x.x.x:yyy'. Here is a screenshot of scanning 10.9.27.32 on port 443: The firewall is only presenting a single certificate and not the full chain we are expecting. If the firewall is modified to send the full chain, more certificates will be presented. Here is the output in that scenario: It is visible that multiple certificates are presented once the issue on the firewall is corrected, and the full chain is sent.