|
By default, the EMS server will generate its default CA certificate which needs to be manually imported to the FortiGate.
Refer to this document for more detail: FortiClient EMS.
In case users want to use personal certificates, FortiGate must trust the certificate chain to authorize the EMS server. If the root CA certificate has been imported but the error still occurs, this would mainly be because the intermediate CA certificate is not properly imported which can be solved by following these steps:
- From the EMS GUI page, download the intermediate CA certificate. In this case, it is R3. Choose the right certificate and select export.
- When downloaded, upload this to FortiGate as CA Certificate.
Note: In case of using VDOMs, upload the certificate to the global VDOM besides the VDOM that the fabric connector is in.
- After this, re-create the EMS connector again and the server will be authorized.
- If the 'EMS server certificate is not signed by any known CA' error still appears, check all CA certificates were correctly added to the FortiGate (wildcard, R3 and ISRG). They should appear in the area of the certificate under Remote CA Certificate.
In the configuration side :
set status enable
set name "test"
set dirty-reason none
set fortinetone-cloud-authentication disable
set server "server-name.com"
set https-port 443 <----- Port should be responsive.
Try to ping the server and the IP resolved to:
exe ping server-name.com
If the freely available Let's Encrypt certificates are used on the EMS (Adding an SSL certificate to FortiClient EMS), updated root CA and intermediary CA are available for download in multiple formats from Chains of Trust - Let's Encrypt (letsencrypt.org).
The following commands can be helpful with troubleshooting the Fabric connection between FortiGate and EMS.
- Test FortiGate to FortiClient EMS connectivity: diagnose endpoint fctems test-connectivity <EMS>
- Verify FortiClient EMS’s certificate: execute fctems verify <EMS>
- Show EMS connectivity information: diagnose test application fcnacd 2
|
