Certificate error when configuring Captive Portal authentication using Azure AD SAML

[Edward-Q]

Hello Fortinet Community,

I’m trying to configure Captive Portal authentication using Azure AD SAML on my FortiGate firewall, but I’m running into a certificate error during the authentication process.

Here’s what I’ve done so far:

• Imported the Azure AD IdP certificate into FortiGate.
• Configured the SAML SP settings on FortiGate (Entity ID, SSO URL, Logout URL using public FQDN).
• Created the user group and enabled Captive Portal on the interface.
• Policies are in place to allow Azure endpoints without authentication.

Despite this, the login redirect works, but the process fails with a certificate-related error.

Questions:

• Has anyone successfully resolved this certificate error when using Azure AD SAML for Captive Portal?
• Do I need to use a publicly signed SSL certificate on FortiGate for the SP URLs?
• Any tips on matching the certificate requirements between Azure AD and FortiGate?

Any guidance or examples would be greatly appreciated!

[AEK]

Hi Edward

I didn't try with Azure AD but the below links should help.

https://docs.fortinet.com/document/fortigate-public-cloud/7.6.0/azure-administration-guide/584456/co...

https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial#configure-azur...