Troubleshooting Tip: SSL VPN certificate issues from FortiClient Microsoft Store App

[dwickramasinghe1]

Description	This article describes how to troubleshoot SSL VPN certificate issues from the FortiClient Microsoft Store App.
Scope	FortiClient Microsoft App, FortiGate.
Solution	The FortiClient Microsoft Store App is commonly used with laptops that have ARM-based processors. Currently, the standalone and EMS version of FortiClient does not support ARM-based processors so the FortiClient Microsoft Store App is used as an alternative. The SSL VPN tunnel mode is no longer supported starting from v7.6.3:  SSL VPN tunnel mode no longer supported From March 20, 2025, FortiClient for ARM architecture (FortiClientVPNSetup_7.4.3.1790_ARM64.exe) has been published on the Fortinet Support Portal. When attempting to connect to SSL VPN with the FortiClient App, the endpoint needs to fully trust the SSL VPN certificate otherwise the following will happen: "SSLVPN Error: Code=-30001010(v1.0.1041) HTTPS failed(NullResponse) HTTPS Exception: HResult=0x80072F0D The certificate authority is invalid or incorrect" To resolve this, ensure that the SSL VPN CA certificate is installed on the endpoint certificate store. Check the SSLVPN certificate configured under VPN -> SSL-VPN settings. Check the Certificate Authority(issuer) from the configured SSLVPN certificate under System -> Certificates  -> Locate the configured SSL VPN certificate and check the issuer information field. Download the correct CA certificate and upload the file onto the endpoint certificate store: Another SSL VPN error regarding certificates includes the common name mismatch. The SSL VPN URL will need to match the common name value or the subject alternate name value within the SSLVPN certificate. If these two values do not match, then the following error will occur: SSLVPN error: code= -30001010(v1.0.1041) HTTPS failed.(NullResponse) HTTPS Exception: HResult=0x80072F06 The host name in the certificate is invalid or does not match Note: This error is unrelated to the certificate authority error from above. It is possible that the endpoint trusts the CA but does not trust the connection due to this mismatch This error occurs because the SSL VPN URL does not match the CN/SAN value on the SSL VPN certificate: To resolve this, it is recommended to change the SSL VPN URL to match the common name of the SSL VPN certificate. As an alternative, it is also possible to utilize the 'subject alternative names' (SAN) within the certificate. To ignore certificate warnings from the FortiClient Microsoft App, add '?ice=1' at the end of the SSL VPN URL. (using 'ice=1' tells Windows to ignore server certificate errors). Note: There is no technical support offered for this application, nor integrated with FortiClient EMS.