Client certificate for SSLVPN

[Hussien_Idris]

Hi, i have created an openssl certificate and successfully imported to fortigate then downloaded the selfsigned certificate and imported to my machine. I want to introduce the two factor security i.e. load a certificate onto each of the clients that are connecting to the Fortigate. I have selected the option ' Require Client Certificate' but am not sure what Certificate to use? appreciate your cooperate and feedback regarding how to add certificate to be selected from the client certificate in forticlient tool. attached FYR..

thank you

Hussien Idris

[emnoc · Accepted solution]

Good now here's a few things to check out

[ul]

is the certificate  sha1 or sha256? ( I've had no luck with SHA256 certs BTW  YMMV)[/ul][ul]

What cert-store did you installed it in ? ( personal > Certificates )[/ul][ul]

Is the certificate labeled for "user-authentication"  purpose ?[/ul][ul]

Did you apply or not-apply  a passphrase  during the import?[/ul][ul]

Is the certificate valid ( not expired )?[/ul][ul]

Is your system clock good  & correct ?[/ul]

Use windows prompt certmgr.msc and validate the above and storage. And restart the forticlient.

[Paul_S]

Did you get this figured out? Do you understand PKI and how a CA behaves?

[theG]

Hi,

I'm also having this same issue. I've managed to get Forticlient working on Android + IOS devices with the same certificate also generated from OpenSSL, but not windows based device because it's not showing the certificate...

Anyone out there have a working solution on how to get the certificate to show up in Forticlient for windows?

G

[emnoc]

1st question, what type or format is the certificate in pem or pkcs12? You will need to have probably convert the certificate into pkcs12 ( aka p12 ) and you can do that via a openline  convertor or via openssl

openssl pkcs12 -export -inkey < the key file > -in < the certificate file > -out < the new pkcs filename>

Than import the  new pkcs file via the windows certificate manager.

[theG]

Hi Emnoc,

The format is already pkcs12 / p12. Imported into "user account" and "local" personal and trusted folders, but still not showing up in Forticlient dropdown...

[emnoc · Accepted solution]

Good now here's a few things to check out

[ul]

is the certificate  sha1 or sha256? ( I've had no luck with SHA256 certs BTW  YMMV)[/ul][ul]

What cert-store did you installed it in ? ( personal > Certificates )[/ul][ul]

Is the certificate labeled for "user-authentication"  purpose ?[/ul][ul]

Did you apply or not-apply  a passphrase  during the import?[/ul][ul]

Is the certificate valid ( not expired )?[/ul][ul]

Is your system clock good  & correct ?[/ul]

Use windows prompt certmgr.msc and validate the above and storage. And restart the forticlient.

[theG · Accepted solution]

Hi,

Just thought I'd post to say I've managed to get everything working now. Stumbled across this post and followed instructions and now all is well.

https://community.spiceworks.com/how_to/93311-fortigate-ssl-vpn-2-factor-authentication-using-open-s...

 thanks for your help emnoc

theG