Fortigate 7.4.8 or 7.6.4 Virtual Server intermediate certificate problem

[AlexeyU]

Hello All,

Have issue on both Fortigate's (v 7.4.8 and 7.6.4). I'm import endpoint certificate via PFX (wildcard). Import two certificates - root and intermediate to "Remote Certificate". If I open info of endpoint certificate and view Serial Numbers of intermediate and ca certificates - its identical for Serial Numbers of imported certificates.

But in test via 
openssl s_client -connect mysite:443 -servername mysite -showcerts

I'll see error "Verify return code: 21 (unable to verify the first certificate)"

What's wrong, what I missed?

[AEK]

Hi Alexey

When you open the location on the browser of the same client, is it trusted? And do you see the certificate chain when you click view certificate? I guess yes.

On my Linux the openssl command doesn't use the same CA path as the Web browser (I don't know for Windows), so I need to install the CA for system-wide trust in order to be trusted by openssl.

[AlexeyU]

Yes, web site is trusted. All chain is visible and I can view certificates. My colleague said that the problem occurs if the intermediate certificate is not received from the web server. I went to check and found a error..

Another one - I have old Microsoft TMG server and have a published the same web-server with the same public certificate - no error with intermediate certificate via openssl checking.

I conducted all tests on one computer.

[funkylicious]

hi,

try importing the CA certificate as a Remote CA certificate ( Import CA Certificate ) alone.

in it, under Details you should see something similar with:

X509v3 Basic Constraints CA:TRUE

X509v3 Key Usage Digital Signature, Certificate Sign, CRL Sign