Forticlient 7.2.4 trying to use certificates when not configured

[DavidAno]

Hello all,

We just upgraded to FortiClient 7.2.4 and having a strange issue, not sure if this is a bug or if there is some configuration change we can make to prevent this.   

We are using SAML login, but for some reason FortiClient keeps trying to use certificates that exist in the users personal certificate sore that are totally unrelated to our VPN.  We have never used certificate based authentication, its not even configured on the firewall.   But for some reason when we try to connect using SAML it fails and the log below is generated in the certificates log for Forticlient.   If i disable single sign-on and just connect with un/pw then it works fine and the certificate issue doesnt happen.

This is happening on a per-user basis, meaning that on the same computer with the same exact configuration if 2 different users try to use FortiClient it will work for 1 but not the other.   I found that the issue is related to certificates

existing in the User's personal certificate store.   If I move the certificates out of the personal store then the VPN start working as expected.   Obviously this is not a good solution as the certificates are needed for other software.

Need to figure out how to prevent FortiClient from trying these other random certificates that exist.

I explained some more symptoms of the issue here - https://community.fortinet.com/t5/Support-Forum/FortiClient-VPN-Error-6005/td-p/303566

Searching CERTS_ENUM_SMARTCARDS

Looking for certs with and without pvt keys

Certificates_EnumTunnelCerts called. isSSL=1 includeLocations=65535 bMustHavePvtKey=0

Certificates_EnumTunnelCerts 490 sec_get_account_type()=520214896

Certificates_EnumTunnelCerts 493 sec_get_user_type()=0

Certificates_EnumTunnelCerts shadow_mode_enabled=502

Certificates_EnumTunnelCerts - looking in user store.

Certificates_EnumTunnelCerts - not looking in computer store.

Certificates_EnumTunnelCerts - looking on smartcards.

Certificates_EnumTunnelCerts call Certificates_LoadFilters

Certificates_LoadFilters tunnelName=3a7a5770, isSSL=1 &filters=000000E833BFCB70, &nFilters=000000E833BFCB78

Certificates_LoadFilters Open software\Fortinet\FortiClient\Sslvpn\Tunnels\MFA VPN

Certificates_LoadFilters Opened software\Fortinet\FortiClient\Sslvpn\Tunnels\MFA VPN

Searching CERTS_ENUM_USER_STORE

Looking for certs with and without pvt keys

Cert "Adobe Intermediate CA 10-3\Adobe Content Certificate 10-5" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Intermediate CA 10-3\Adobe Content Certificate 10-5" - ACCEPT

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-3" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-3" - ACCEPT

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-4" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Root CA 10-3\Adobe Intermediate CA 10-4" - ACCEPT

Cert "Adobe Intermediate CA 10-4\Adobe Content Certificate 10-6" has OIDs:

  2.5.29.15

  2.5.29.19

Cert "Adobe Intermediate CA 10-4\Adobe Content Certificate 10-6" - ACCEPT

Searching CERTS_ENUM_SMARTCARDS

Looking for certs with and without pvt keys

Certificates_GetCertificateFromJSON 753

Certificates_GetCertificateFromJSON 762

Certificates_GetCertificateFromJSON 768 thumbprint=906CC149415780CFB79F39E1CF449F87CA6D4D16

Certificates_GetCertificateFromJSON 775 source=1

Certificates_GetCertificateFromJSON 781

Certificates_GetCertificate 612 hStoreHandle=000002645940A0F0

Certificates_GetCertificate 727 bFoundCert=1

Certificates_GetCertificateFromJSON 753

Certificates_GetCertificateFromJSON 762

Certificates_GetCertificateFromJSON 768 thumbprint=906CC149415780CFB79F39E1CF449F87CA6D4D16

Certificates_GetCertificateFromJSON 775 source=1

Certificates_GetCertificateFromJSON 781

Certificates_GetCertificate 612 hStoreHandle=0000026459427020

Certificates_GetCertificate 727 bFoundCert=1

[spoojary]

It is a known issue : 1008116
Fix Schedule: 7.2.5, 7.4.0

[Daagvandermeer]

When to Expext?

[RCTBD]

This is still occurring with 7.2.8 on a 40F and with 7.0.14 on a 120G 

[AdmiralSYN-Ackbar]

There's a special build of FortiClient that TAC gave me after I opened a ticket on this that resolves the issue.

[jip]

OK Good news. Any idea if that build will be realesed soon or we all have to contact TAC?

[AdmiralSYN-Ackbar]

They didn't give me an ETA on general release. I got this a couple of weeks ago, so it's probably worth opening a ticket on rather than waiting if you are in need of it.

[ereta]

In case anyone is interested, I downloaded the "Online Installer" of FortiClient VPN from the following site, and then run it in "Repair" mode, that seems to have solved the issue.

https://www.fortinet.com/support/product-downloads#:~:text=How%20to%20Buy-,FortiClient%20VPN,-The%20...

[8a]

Hi,
Could you share the link to that fixed version?

[Zoyashah]

Forticlient 7.2.4 is attempting to utilize certificates despite lacking proper configuration, leading to potential authentication errors and security vulnerabilities. Our technical team is investigating this issue to rectify the misconfiguration promptly. By ensuring proper certificate setup and alignment with security protocols mugs, we aim to mitigate risks associated with unauthorized access and data breaches. Resolving this issue is critical to maintaining the integrity and effectiveness of our network security measures.