Technical Tip: How to enable Client Certificate Verification in FortiWeb Server Policy

[kmak]

Description	This article describes how to enable Client Certificate Verification in the FortiWeb Server Policy.
Scope	FortiWeb.
Solution	Prerequisite: FortiWeb Server Policy enabled HTTPS Protocol Service. CA and User Certificate generated from the local device. Log into FortiWeb GUI and navigate to Server Objects -> Certificates -> CA.      Import the CA root cert generated from the local server which is used to sign the users’ certificate. The imported CA cert is shown on the page: Then navigate to the CA Group tab and create a new CA Group. Select the imported CA into the CA Group member. Go to the Certificate Verify page and create a new Certificate Verify group. Select the created CA Group in the Certificate Verify group. Go to the Server Policy and edit the policy that is required to be enabled with the Client-side certificate verification. Select the Advanced SSL settings and the dropdown menu of Certificate Verification for HTTPS, and select the created Certificate Verify group. Then, save the policy settings. The Server Policy is now enabled with Client-side certificate verification. Now ensure that the client’s device has imported the user certificate signed by the CA cert. Try to browse the webpage protected by the server policy. The page shall prompt with the client’s SSL certificate selection. Select the correct certificate to browse the page. Related document: How to apply PKI client authentication (personal certificates)