MacOS 15 login screen pop-up from FortiClientAgent: "You are making changes to your Certificate Trus

[LeadTogether]

On MacOS 15 (FortiClient version 7.2.6), at the MacOS login screen a message appears prompting for credentials.  The message states:

FortiClientAgent

You are making changes to your Certificate Trust Settings.

Enter the name and password of a user in the "(null)" group to allow this.

No matter what credentials are entered, it won't accept them.

I've opened a case with support, to no avail so far.

They referred me to this article (for an older version of FortiClient), and I added all the services it mentions that need full disk access and checked the other settings:

https://docs.fortinet.com/document/forticlient/7.0.9/macos-release-notes/223986

I would investigate downgrading to see if that helps, but we want to be on the latest release so that we are up-to-date on security patches.

Does anyone have any suggestions?

Thanks in advance for any advice.

[MZBZ]

Please verify the output of  systemextensionsctl list 

https://docs.fortinet.com/document/forticlient/7.2.8/macos-release-notes/223986/special-notices

[LeadTogether]

Thanks for the suggestion.

The output of "systemextensionsctl list" matches the article.

[LeadTogether]

I uninstall 7.2.6 and installed the latest 7.2.x version (7.2.8) and also minimized the features installed (in EMS) to just remote access and vulnerability scanning.  No change.

The problem only appears at the login screen.

If I uninstall the FortiClient, the same prompt appears but with a valid user ID and it works to put the password in.  It also works OK when installing FortiClient.  (The prompt appears within a minute after installing.)

What appears to be happening is that the FortiClientAgent is running at startup, before a user logs-in, and for whatever reason it is trying to modify a certificate store.  MacOS requires credentials for that, but since no one is logged-in, it prompts for "null" credentials, which don't work.

This appears to be a bug.  I haven't seen anything in the 7.2.x release notes about it though.

[LeadTogether]

To clarify, this is what the dialog looks like.  No matter what credentials are entered, they are not accepted.

[LeadTogether]

And something else I discovered: The prompt will appear at the login screen even after logging out of MacOS, not just upon restarting the system.

[MZBZ]

Try a fresh reinstall: FortiClient blank console on Mac - Fortinet Community

[LeadTogether · Accepted solution]

FortiNet support took a look at it and eventually determined that this is a bug in version 7.2.6 and 7.2.8.

[LeadTogether]

I tested the 7.2.9 FortiClient for Mac release and confirmed that the problem is fixed.