FortiClient 7.2.x (also 7.4.x) shows invalide certificate warning after every reboot of the client

[Harold080868]

Hello,

FortiClient 7.2.x (also 7.4.x) shows invalide certificate warning after every reboot of the client, also the setting to do this on ems are not enabled. Any idea?

Fortinet says this normal.....

[AEK]

Hi Harold

Is it when it tries connect to SSL VPN or before? I mean since you said after every reboot then it can be related to telemetry, right?

[Harold080868]

Hi AEK,

yes it is when I try to connect via SSL VPN (it is not the telemetry). When I connect a second time without reboot, it is not. FortiClient 7.0.x has not the behavior. Import the root certificate to the browser has no effect.

[AEK]

Is the remote FQDN configured in your SSL VPN connection the same as the certificate DN or SAN?

Is the issuer trusted by the client? Do you have its CA certificate on the client?

[Harold080868]

Hi AEK,

Is the remote FQDN configured in your SSL VPN connection the same as the certificate DN or SAN?
No, the certificate is fortinet default. With FortiClient 7.0.x it works.

Is the issuer trusted by the client? Do you have its CA certificate on the client?
As wrote this has no effect, if the issuer is installed to the browser or not.

[AEK · Accepted solution]

Hi Harold

Then it is normal to receive a certificate warning.

If you don't want to receive the warning then the certificate DN/SAN should be the same as the FQDN configured in your VPN connection.

In your 7.0.x probably the certificate warning was disabled, that's why you didn't see the warning.

[Harold080868]

Hi AEK,

thank you for your explanation. I'am not amused Fortinet change the properties, but I think I have no influence.

Best Regards

Harold