Fortigate not allowing SSL VPN with new Certificate Authority

[manuelq]

We  utilize a sslvpn with an external issued CA, the CA expired recently and we received a new CA and added it to the Fortigate - the sudo global CA details liste the new CA as the source - but clients get "permission denied" and the log on the client show SSL Unknown 9 Failed to log into fortigate -131. 

The same new CA and certs work on a cisco vpn tool for verification. 

[Anthony_E]

Hello Manuel,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[Anthony_E]

Hello Manuel,

I have found this document:

https://docs.fortinet.com/document/fortigate/6.2.11/cookbook/266506/ssl-vpn-with-certificate-authent...

Could you please tell me if it helped?

Regards,

[Markus_M]

Hi Manuel,

you will need to see whether the certificates are installed where they belong. There will be one node sending a certificate, the other will have to verify it. Verification is done with the CA cert. If there is an intermediate CA cert, this is to be included.

Making a guess on your configuration, standard SSLVPN: The client is only receiving a server certificate (FortiGate has this newly issued Server certificate by your new CA set in the SSLVPN settings), The client requires having the root CA installed. Do make sure you have a new server certificate issued by your new CA. The old certificate cannot be used anymore as the certificate chain verification will not work out.

If there is an intermediate CA, make sure this is ALSO installed in the FortiGate.

To install the rootCA in this mentioned case on the FortiGate is not required.

If your FortiGate has the option set of requiring a client certificate, then additionally to the process above, the client will send a client certificate to the FortiGate which then also needs to verify it and have the rootCA installed and the intermediate, if any.

More about certificates:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-TLS-and-the-use-of-Digital-Certificates/ta...

Best regards,

Markus