I'm happy to say that I identified the cause, found a workaround (for users) and a solution (for the Fortinet developers to implement).
(Workaround for users: see step 2 below.)
Hint: Fortinet can fix this problem easily by updating their source code, see below.
The reason why we are getting a certificate warning on openSUSE is the following:
The FortiClient VPN program is trying various places to find the system's CA bundle. So far, so good. However:
Below are the files it is trying to access on openSUSE:
./forti.pid.3283:2206:access("/etc/ssl/certs/ca-certificates.crt", R_OK) = -1 ENOENT (No such file or directory) ./forti.pid.3283:2207:access("/etc/pki/tls/certs/ca-bundle.crt", R_OK) = -1 ENOENT (No such file or directory) ./forti.pid.3283:2208:access("/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", R_OK) = -1 ENOENT (No such file or directory)
None of these exist. On openSUSE, the CA bundle can be found at:
/etc/ssl/ca-bundle.pem
Hence, the FortiClient fails to verify the root certificate of the SSL VPN endpoint, and that's why we get a certificate warning.
So, in summary, to make FortiClient work properly on openSUSE, Fortinet will have to do these things:
1. Develop an AppArmor profile, to make FortiClient work (better) on systems that use AppArmor, like openSUSE (and Ubuntu).
2. Fix the FortiClient code so it will _also_ try to access the following location to find the system's CA bundle:
/etc/ssl/ca-bundle.pem
Until then, a workaround that users can apply is this:
$ sudo ln -s /etc/ssl/ca-bundle.pem /etc/ssl/certs/ca-certificates.crt
If the link (last parameter) already exists, this will do nothing, which is good, since in that case no action should be necessary.
Other ways in which the Fortinet developers might solve the problem are:
- Install their own CA bundle along with FortiClient.
- Or use the system's built-in methods (if any are deemed suitable by the developers) of verifying certificates so FortiClient doesn't even have to know about the locations of the CA bundles.
Perhaps such options have already been considered and are either rejected or planned.
3. Test and review the code changes.
4. Done.
For the curious, the way I debugged this problem is the following:
I temporarily disabled the forticlient service, then rebooted, and executed the following command:
sudo strace -ff --output=forti.pid /opt/forticlient/fctsched
The /opt/forticlient/fctsched part was found in /usr/lib/systemd/system/forticlient.service, that's how we know which command to use to manually run the service via 'strace'.
Then I used the FortiClient VPN GUI program as normal so that the trace files contain useful information.
So, looking back at the original forum post: yes, even though the individual SSL certificate files were found on openSUSE in the same place as on other systems ( namely /etc/ssl/certs ), the location of the CA bundle was different.
