Forticlient SSL VPN doesn't show the certificate to select

[Alpha7]

Hi

I would like to implement SSL VPN with certificate authentication. I have configured SSL VPN with PKI users and CA certificate is uploaded to  Fortigate. client certificate is installed in root certificate folder. when i try to choose the certificate from Forticlient SSL VPN setting, it is not showing the installed certificate from the list. Has anyone faced this issue before? But if i select IPsec VPN option from Forticlient, i can see the the certificate from list.

Thanks

A

[Iescudero · Accepted solution]

Thush wrote:

So, should Forticlient expect the certificate format in pfx only?

Yes, I think it does.

Thush wrote:

If so, how do i roll out the p12 format certificate to clients through GPO?

I think there are a few different options to do this, but i never do it myself.

This guy says that he can do it with a .bat script with the certutil tool: https://www.jasonpearce.com/2012/02/02/import-pfx-certificate-via-group-policy-preferences/

And this article explain how to do it with a GPO: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc...

Hope it helps!

[Hosemacht]

Hi Apha,

have you tried this:

http://cookbook.fortinet.com/ssl-vpn-with-certificate-authentication/

Regards

[Iescudero]

HI there Alpha7!

I think that the Client certificates must be installed in the personal folder, not in the root certifitcate folder and that's why you can't see it after you installed it.

Hope it Helps!

[Alpha7]

Hi

I tried to install in root certificate folder and personal folder as well but no luck. If i install the certificate in p12 format, it appears from Forticlient SSL VPN configuration. But if you install .cer format certificate, it doesn't appear in SSL VPN configuration. We would like to push .cer format to clients through GPO. is there any permission related issue here? client PC has got admin rights

Thanks

[Iescudero]

i forgot to ask what is the format of the certificate. I think is not related to user permissions.

.cer is just the certificate with a public key.

The .p12 or the .pfx file usually contains the private key also, and this is needed for the Forticlient for use it.

[Alpha7]

In that case, Fortigate act as server and hold CA certificate with public key and client should have private key. So, should Forticlient expect the certificate format in pfx only? If so, how do i roll out the p12 format certificate to clients through GPO?

[Iescudero · Accepted solution]

Thush wrote:

So, should Forticlient expect the certificate format in pfx only?

Yes, I think it does.

Thush wrote:

If so, how do i roll out the p12 format certificate to clients through GPO?

I think there are a few different options to do this, but i never do it myself.

This guy says that he can do it with a .bat script with the certutil tool: https://www.jasonpearce.com/2012/02/02/import-pfx-certificate-via-group-policy-preferences/

And this article explain how to do it with a GPO: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc...

Hope it helps!

[emnoc · Accepted solution]

I think it depends on the OS but yes in  WinOS MACosx the certificate is imported and as p7 or p12 format . Once  you have the certificate installed & as user certificate you can call it up via the client.

For  deliverance via GPO, I believe only  MS-CA originated certificates can be delivered via a GPO. You  can follow any of the  numerous KBs for  GPO deliver.

[vinisantos_FTNT]

Certificates can be installed either on the user or the machine certificate stores.

And FortiClient will only show certificates with a key associated with them (e.g.: pfx). ".cer" certificates won't be available for selection for VPN authentication.