Troubleshooting Tip: Persistent Agent Macintosh TLS Handshake Issue

[scitlak]

Description	This article describes why in some cases, even though a local Root Certificate has been imported in Keychain and marked as 'Always Trusted', MacOS may consider this Root Certificate as untrusted. As a result, the TLS Handshake between Persistent Agent and FortiNAC may not be established. In this case, even though a local Root Certificate has been imported in Keychain and marked as 'Always Trusted', it would be possible to see the following in Persistent Agent logs: SSL_get_verify_result = 19 ... ... ... Checking Peer name fortinac.lab.local against Common or Subject-alternative-name entry fortinac.lab.local Peer name "fortinac.lab.local" matches "fortinac.lab.local" Refusing to connect to trust_DISTRUSTED fortinac.lab.local|fortinac.lab.local|6f:b5:1a:98:96:81:e7:49:e9:2f:b9:d2:7e:91:ff:ab:90:d2:9a:8a Connection failed! 1
Scope	FortiNAC v9.x.y, and FortiNAC-F v7.x.y.
Solution	Update the Persistent Agent to the latest version. In affected MACOS, copy the root Certificate under directory /users/admin. Execute the below command on MACOS CLI to import the root Certificate as trusted: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/your-root-ca-name.cer After, restart the Persistent Agent by using the following commands: sudo launchctl unload /Library/LaunchDaemons/com.bradfordnetworks.agent.plist sudo launchctl load /Library/LaunchDaemons/com.bradfordnetworks.agent.plist Related articles: Technical Tip: Persistent Agent fails to communicate with 'SSL_get_verify_result' log entry. Technical Tip: macOS Persistent Agent logs  Guide: Persistent Agent on MacOS Guide: Installing ssl certificates