Troubleshooting Tip: FortiClient VPN stops at 40% with PKI users

[RobBlenk]

Description	This article describes what could be the cause if the FortiClient VPN fails to connect at 40% with PKI certificate authentication.
Scope	FortiClient SSL VPN with PKI certificate authentication.
Solution	The logs will show the Action as 'ssl-exit-error' and the Reason as 'DH lib'. SSL-VPN application real time debug will show the following: client cert requirement: yes SSL state:SSLv3/TLS read client hello (x.x.x.x) SSL state:SSLv3/TLS write server hello (x.x.x.x) SSL state:SSLv3/TLS write certificate (x.x.x.x) SSL state:SSLv3/TLS write key exchange (x.x.x.x) SSL state:SSLv3/TLS write certificate request (x.x.x.x) SSL state:SSLv3/TLS write server done (x.x.x.x) SSL state:SSLv3/TLS write server done:system lib(x.x.x.x) SSL state:SSLv3/TLS write server done:DH lib(x.x.x.x)      <-- After the DH line, the connection fails. SSL_accept failed, 5:(null) Uninstall and reinstall the client certificate. Note: In this instance the client certificate is not expired. It just needs to be reinstalled. Troubleshooting: diagnose debug reset diagnose vpn ssl diagnose debug application sslvpn -1 diagnose debug enable Related article: Technical Tip: PKI user with two factor authentication for SSL VPN.