Client certificate authentication fails.

[kazuki]

■Equipment Information
model number:FG-60F-FW-US
version:v7.2.5

■Questions
Use ssl-vpn in tunnel mode.
Authentication methods are client certificate, ID and password.

9 PKI users were created.
The client certificate is a file common to all users.
However, when I try to connect from FortiClient(Windows10), only one particular user can connect to the VPN. If I try to connect with the rest of the users, the connection fails.
I would like to know about the cause. Thank you in advance.

[dbhavsar]

Hello @kazuki ,
- Can we know at what percentage it is failing?
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL...

or if you can get debugs while connecting that will also help why it is failing
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542

[kazuki]

Ignore this sentence.

[kazuki]

Ignore this sentence.

[kazuki]

Hello @dbhavsar 

Thanks for the reply.

At 48%, I get an error message.
The error message is as follows.
"VPN connection cannot be established, VPN server may not be reachable (0)"

[dbhavsar]

Hi @kazuki
please try to disable TLS 1.0 / 1.1 in internet options, if that does not helps please collect the following debugs and open up a ticket with TAC:

diagnose debug application sslvpn -1

diagnose debug application fnbamd -1

diagnose debug console timestamp enable
diagnose debug enable

[kazuki]

Hi @dbhavsar 

Thank you very much. I will try it.

[Debbie_FTNT]

Hey kazuki,

if it fails at 48%, that usually indicates the FortiGate/remote authentication server doesn't like a second factor (FortiToken prompt and check happen at 45 and 48% for example), in your case the certificate.
If it only works for one user out of nine - does it only work for one user at a time, and all other eight will fail while that user is connected, but can connect later, or does it only work for one particular user, and all other users fail all the time?

-> if only one user can connect at a time (no matter which user) this sounds like a limitation in concurrent logins; perhaps because the same user certificate is used, FortiGate considers each connection as the same PKI user and enforces a limit?

-> if only one particular user can connect, and the other eight will always fail, this sounds as if the certificate is only accepted for that user, perhaps because the subject matches that username, or the certificate is associated with that particular user in another way?

As dbhavsar suggested, a TAC ticket might provide some clarity :)

[kazuki]

Hi @Debbie_FTNT 

Thanks for the reply.

If it only works for one user out of nine - does it only work for one user at a time, and all other eight will fail while that user is connected, but can connect later, or does it only work for one particular user, and all other users fail all the time?
→all other users fail all the time.

-> if only one user can connect at a time (no matter which user) this sounds like a limitation in concurrent logins; perhaps because the same user certificate is used, FortiGate considers each connection as the same PKI user and enforces a limit?

-> if only one particular user can connect, and the other eight will always fail, this sounds as if the certificate is only accepted for that user, perhaps because the subject matches that username, or the certificate is associated with that particular user in another way?

→I understand that Foritigate requires user certificates for the number of PKI users.

I would like to make an additional confirmation,
Is it possible to use the default server certificate (Fortinet_Factory) for client certificate authentication?I am using the default server certificate, is this irrelevant to this case?

[Debbie_FTNT]

Hey kazuki,

technically, if you make a PKI user vague enough, it can match more than one user. The 'subject' value in a PKI user is a substring match, so if you take a part of the subject all users have in common (like a department name or similar) and filter on that, all users would match the PKI user and should be allowed that way.

As for using the default server certificate for client certificate authentication - IF the FortiGate acts as client, it could in theory (probably) utilize the Fortinet Factory certificate. However, the certificate's private key cannot be exported (only the certificate itself), meaning no other device can use it, as using a certificate for authentication requires possession of the private key.