Forticlient 7.2.4 trying to use certificates when not configured

[DavidAno]

Hello all,

We just upgraded to FortiClient 7.2.4 and having a strange issue, not sure if this is a bug or if there is some configuration change we can make to prevent this.   

We are using SAML login, but for some reason FortiClient keeps trying to use certificates that exist in the users personal certificate sore that are totally unrelated to our VPN.  We have never used certificate based authentication, its not even configured on the firewall.   But for some reason when we try to connect using SAML it fails and the log below is generated in the certificates log for Forticlient.   If i disable single sign-on and just connect with un/pw then it works fine and the certificate issue doesnt happen.

This is happening on a per-user basis, meaning that on the same computer with the same exact configuration if 2 different users try to use FortiClient it will work for 1 but not the other.   I found that the issue is related to certificates

existing in the User's personal certificate store.   If I move the certificates out of the personal store then the VPN start working as expected.   Obviously this is not a good solution as the certificates are needed for other software.

Need to figure out how to prevent FortiClient from trying these other random certificates that exist.

I explained some more symptoms of the issue here - https://community.fortinet.com/t5/Support-Forum/FortiClient-VPN-Error-6005/td-p/303566

Searching CERTS_ENUM_SMARTCARDS

Looking for certs with and without pvt keys

Certificates_EnumTunnelCerts called. isSSL=1 includeLocations=65535 bMustHavePvtKey=0

Certificates_EnumTunnelCerts 490 sec_get_account_type()=520214896

Certificates_EnumTunnelCerts 493 sec_get_user_type()=0

Certificates_EnumTunnelCerts shadow_mode_enabled=502

Certificates_EnumTunnelCerts - looking in user store.

Certificates_EnumTunnelCerts - not looking in computer store.

Certificates_EnumTunnelCerts - looking on smartcards.

Certificates_EnumTunnelCerts call Certificates_LoadFilters

Certificates_LoadFilters tunnelName=3a7a5770, isSSL=1 &filters=000000E833BFCB70, &nFilters=000000E833BFCB78

Certificates_LoadFilters Open software\Fortinet\FortiClient\Sslvpn\Tunnels\MFA VPN

Certificates_LoadFilters Opened software\Fortinet\FortiClient\Sslvpn\Tunnels\MFA VPN

Searching CERTS_ENUM_USER_STORE

Looking for certs with and without pvt keys

Cert "Adobe Intermediate CA 10-3\Adobe Content Certificate 10-5" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Intermediate CA 10-3\Adobe Content Certificate 10-5" - ACCEPT

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-3" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-3" - ACCEPT

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-4" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-4" - ACCEPT

Cert "Adobe Intermediate CA 10-4\Adobe Content Certificate 10-6" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Intermediate CA 10-4\Adobe Content Certificate 10-6" - ACCEPT

Searching CERTS_ENUM_SMARTCARDS

Looking for certs with and without pvt keys

Certificates_GetCertificateFromJSON 753

Certificates_GetCertificateFromJSON 762

Certificates_GetCertificateFromJSON 768 thumbprint=906CC149415780CFB79F39E1CF449F87CA6D4D16

Certificates_GetCertificateFromJSON 775 source=1

Certificates_GetCertificateFromJSON 781

Certificates_GetCertificate 612 hStoreHandle=000002645940A0F0

Certificates_GetCertificate 727 bFoundCert=1

Certificates_GetCertificateFromJSON 753

Certificates_GetCertificateFromJSON 762

Certificates_GetCertificateFromJSON 768 thumbprint=906CC149415780CFB79F39E1CF449F87CA6D4D16

Certificates_GetCertificateFromJSON 775 source=1

Certificates_GetCertificateFromJSON 781

Certificates_GetCertificate 612 hStoreHandle=0000026459427020

Certificates_GetCertificate 727 bFoundCert=1

[hd-systems]

We have the same issue, definitely a bug that needs to be resolved by Fortinet.

Deleting only the Adobe personal certificates was enough as a workaround (we have kept other certificates and have no problems).

[dombilod_forti]

Same issue here.

In our case the certs are used by our developers and we cannot delete them.

The only thing that might be related to this is that 2 weeks agos I did some testing with Cert authentication on the Fortigate, but deleted everything related to these testing since then, and rebooted the fortigate as well.   Could it be possible that the fortigate is configuring an option that is not obvious to see and that is still in our config ?

Is this the case for some of you ?

[dombilod_forti]

Also DavidAno did you find a workaround for this ?

We opened a ticket yesterday with Fortinet.  Let's see how it goes.

[KH69]

Same exact issue here :( Just upgraded to 7.2.4 and getting the same error.  There were no certs though in the user store so not sure where to go from here :(

[jip]

Exact same issue and even by rolling back to 7.2.3.0929 did not fix the issue of all our machines. For now if we are lucky we can select any certificate and this seems to work for now.

=> Fortinet, please release a fix very quickly as we have many users impacted

[MichelleT]

Submitting a ticket with Fortinet Support, help me resolve the issue.

Originally I was using 7.0.9, so uninstalled the latest release ( 7.2.4) and rolled back to 7.0.11. The connection is being established as before (no certificate required)

Mind you, since I 'm using the free version of the FortiClient is support is limited. Hopefully someone using the paid version will open a ticket and get a better solution to this certificate problem.

[martstonge]

I just sent my logs to support.  Let's see what they will tell me.  I'll post a response here

[RBT]

I send my logs a week before now - waiting for response

[DORNBACH]

We have the same issue. We also have the problem that the reconnect no longer works. When we lost the connection we have an Connection-Loop.

[AdmiralSYN-Ackbar]

I heard back from TAC today. They are aware of the issue and are working on the fix. The workaround is to move user certificates from the user personal store to the trusted root authority store.

I'd like to thanks the participants of this thread for providing a workaround to the issue, this is a frustrating one.