Technical Tip: SAML SSL VPN login page failing to load

[Rajan_kohli]

Description	This article explains how to fix the issue where the SAML login page fails to load, and SAML debugging on FortiGate displays the error message 'Failed to send SAML request'.
Scope	FortiGate, SAML.
Solution	To check this error message take SAML debugs as shown below: diagnose debug reset diagnose vpn ssl debug-filter src-addr4 x.x.x.x  <----- x.x.x.x will be user the public IP. diagnose debug application sslvpn -1 diagnose debug application samld -1 diagnose debug enable To stop the debugs: diagnose debug application sslvpn 0 diagnose debug application samld 0 diagnose debug disable diagnose debug reset The user attempts to log in via SSL VPN using FortiClient or web mode and verifies if the debug logs match the output shown below. 2025-01-30 14:22:38 [257:root:1c7]saml login 455 idp entity: http://www.okta.com/exkjl88mpt1HtmMn7697 2025-01-30 14:22:38 [257:root:1c7]fsv_saml_enter:290 Failed to send SAML request. 2025-01-30 14:22:38 [257:root:1c7]sslConnGotoNextState:324 error (last state: 1, closeOp: 0) 2025-01-30 14:22:38 [257:root:1c7]Destroy sconn 0x7f80111000, connSize=0. (root) 2025-01-30 14:22:38 [257:root:1c7]SSL state:warning close notify (24.60.124.125) To resolve this error, it is necessary to match if the correct SP certificate is used in the IDP configuration or to disable the Service Provider certificate in the SAML configuration. In GUI:  In CLI: config user saml     edit "okta-idp"     unset cert end Related articles: Troubleshooting Tip: Error 'The identifier of a provider is unknown to #LassoServer' for SAML login Troubleshooting Tip: Fix SAML 'access denied' error caused by failure to create SP Technical Tip: FortiGate SAML authentication resource list Troubleshooting Tip: FortiClient SAML authentication when SSL VPN web mode is disabled globally Troubleshooting Tip: How to troubleshoot the error 'do_http_validate:440 method (POST) on uri ... no...