Description
This article describes the various 'SSL_get_verify_result' error code values found in the Persistent Agent log 'general.txt' and probable causes for each.
The file location:
Windows: C:\ProgramData\Bradford Networks\general.txt
Scope
FortiNAC.
Solution
Symptom: Persistent Agent is not communicating (unable to scan, receive messages, etc.).
Retrieve the agent debug logs from one of the affected machines. For instructions, refer to the KB articles below.
The following entries can be found in general.txt log:
SSL_get_verify_result = 10 - Certificate has expired.
SSL_get_verify_result = 13 - Certificate chain contains a self-signed certificate.
SSL_get_verify_result = 14 - format error in certificate's notAfter field
SSL_get_verify_result = 18 - Self-signed certificate in use.
SSL_get_verify_result = 19 - End stations is missing root certificate.
SSL_get_verify_result = 20 - Appliance is missing or has incorrect intermediate certificates installed.
SSL_get_verify_result = 22 - certificate chain too long.
SSL_get_verify_result = 0 - Success.
The messages in detail (apart from success):
SSL_get_verify_result = 10
Verify certification expiration by navigating to System -> Settings -> Security -> Certificate Management in the UI.
SSL_get_verify_result = 13
(Persistent Agent that works on MACOS):
This is in general no issue, but the TLS server should not send the rootCA (which is self-signed); the certificate has to be present on the client anyway. The agent might throw this message, but later agents, 10.7.1.9 or above, will not show this anymore.
SSL_get_verify_result = 18
The server certificate is self-signed and has no valid certificate chain.
SSL_get_verify_result = 19
Verify root certificates on the end station. See the following articles:
SSL_get_verify_result = 20
SSL_get_verify_result = 22
Change 'caTrustDepth' value for Persistent Agent depending on the certificate chain length.
This refers to the byte size of the whole certificate chain, which happens to be too large. See code 13 as well, no rootCA certificate is required to be sent by the server, it must be present on the client already.
All verified error codes can be found in the OpenSSL manual.
If the certificate is expired, renew it. See the Renew a Certificate section in the SSL Certificates reference manual.
Error 14 usually happens on MacOS as Apple requires the certificates to be valid for less than 397 days in total. See this Apple support article for more information. The validity of certificates can be verified from the MacOS Agent logs.
For example:
Validity
Not Before: Dec 12 19:28:50 2023 GMT
Not After : Dec 11 19:28:50 2025 GMT
Related articles:
