When TLS1.3 is enabled, login SSL VPN using smart card (certificate) fails

[littlecutTW]

Fortigate Version : 7.0.12
Forticlient Version : 6.4.10(EMS) and 7.0.9 (free VPN)
PC : Windows 11 21H2

When my computer uses TLS 1.2(IE Option), SSLVPN works normally
But if I switch to TLS1.3, SSLVPN cannot be used (error messages：credential or sslvpn configuration is wrong. -7200)

Fortigate debug log.. I don't know why Forticlient didn't provide the user certificate to Fortigate

[193:root:2f4d]allocSSLConn:307 sconn 0x7f9d92158100 (0:root)
[193:root:2f4d]disable RSA-PSS sigalgos.
[193:root:2f4d]SSL state:before SSL initialization (192.168.1.1)
[193:root:2f4d]SSL state:before SSL initialization:DH lib(192.168.1.1)
[193:root:2f4d]SSL_accept failed, 5:(null)
[193:root:2f4d]Destroy sconn 0x7f9d92158100, connSize=1. (root)
[193:root:2f4e]allocSSLConn:307 sconn 0x7f9d92158100 (0:root)
[193:root:2f4e]disable RSA-PSS sigalgos.
[193:root:2f4e]SSL state:before SSL initialization (192.168.1.1)
[193:root:2f4e]SSL state:before SSL initialization (192.168.1.1)
[193:root:2f4e]got SNI server name: xxFW.xxx.com.tw realm (null)
[193:root:2f4e]client cert requirement: yes
[193:root:2f4e]SSL state:SSLv3/TLS read client hello (192.168.1.1)
[193:root:2f4e]SSL state:SSLv3/TLS write server hello (192.168.1.1)
[193:root:2f4e]SSL state:SSLv3/TLS write change cipher spec (192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 early data:system lib(192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4e]got SNI server name: xxFW.xxx.com.tw realm (null)
[193:root:2f4e]client cert requirement: yes
[193:root:2f4e]SSL state:SSLv3/TLS read client hello (192.168.1.1)
[193:root:2f4e]SSL state:SSLv3/TLS write server hello (192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 write encrypted extensions (192.168.1.1)
[193:root:2f4e]SSL state:SSLv3/TLS write certificate request (192.168.1.1)
[193:root:2f4e]SSL state:SSLv3/TLS write certificate (192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 write server certificate verify (192.168.1.1)
[193:root:2f4e]SSL state:SSLv3/TLS write finished (192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 early data:system lib(192.168.1.1)
[193:root:2f4e]SSL state:TLSv1.3 early data:DH lib(192.168.1.1)
[193:root:2f4e]SSL_accept failed, 5:(null)
[193:root:2f4e]Destroy sconn 0x7f9d92158100, connSize=1. (root)
[193:root:2f4f]allocSSLConn:307 sconn 0x7f9d92158100 (0:root)
[193:root:2f4f]disable RSA-PSS sigalgos.
[193:root:2f4f]SSL state:before SSL initialization (192.168.1.1)
[193:root:2f4f]SSL state:before SSL initialization (192.168.1.1)
[193:root:2f4f]got SNI server name: xxFW.xxx.com.tw realm (null)
[193:root:2f4f]client cert requirement: yes
[193:root:2f4f]SSL state:SSLv3/TLS read client hello (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write server hello (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write change cipher spec (192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 early data:system lib(192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4f]got SNI server name: xxFW.xxx.com.tw realm (null)
[193:root:2f4f]client cert requirement: yes
[193:root:2f4f]SSL state:SSLv3/TLS read client hello (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write server hello (192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 write encrypted extensions (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write certificate request (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write certificate (192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 write server certificate verify (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write finished (192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 early data:system lib(192.168.1.1)
[193:root:2f4f]SSL state:TLSv1.3 early data (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS read client certificate (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS read finished (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write session ticket (192.168.1.1)
[193:root:2f4f]SSL state:SSLv3/TLS write session ticket (192.168.1.1)
[193:root:2f4f]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384
[193:root:2f4f]No client certificate
[193:root:2f4f]req: /remote/info
[193:root:2f4f]capability flags: 0x4df
[193:root:2f4f]req: /remote/login
[193:root:2f4f]rmt_web_auth_info_parser_common:492 no session id in auth info
[193:root:2f4f]rmt_web_get_access_cache:841 invalid cache, ret=4103
[193:root:2f4f]User Agent: FortiSSLVPN (Windows NT; SV1 [SV{v=02.01; f=07;}])
[193:root:2f4f]sslvpn_auth_check_usrgroup:2978 forming user/group list from policy.
[193:root:2f4f]sslvpn_auth_check_usrgroup:3024 got user (0) group (0:2).
[193:root:2f4f]sslvpn_validate_user_group_list:1890 validating with SSL VPN authentication rules (0), realm ().
[193:root:2f4f]sslvpn_validate_user_group_list:2876 got user (0:0), group (0:0) peer group (2).
[193:root:2f4f]sslvpn_update_user_group_list:1735 cert peer check failed, ignore peer user group(s) which has set user-peer in auth rules
[193:root:2f4f]sslvpn_update_user_group_list:1793 got user (0:0), group (0:0), peer group (2) after update.
[193:root:2f4f]get_cust_page:128 saml_info 0
[193:root:2f4f]req: /remote/logincheck
[193:root:2f4f]rmt_web_auth_info_parser_common:492 no session id in auth info
[193:root:2f4f]rmt_web_access_check:760 access failed, uri=[/remote/logincheck],ret=4103,
[193:root:2f4f]User Agent: FortiSSLVPN (Windows NT; SV1 [SV{v=02.01; f=07;}])
[193:root:2f4f]login_failed:391 user[],auth_type=32768 failed [sslvpn_login_cert_checked_error]
[193:root:2f4f]req: /FortiClientSslvpnClearCacheUrl/for/Wini
[193:root:2f4f]def: (nil) /FortiClientSslvpnClearCacheUrl/for/WininetLibrary/1/2/3/4/5/6/7/8/9/0/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t

[srajeswaran]

Looks matching to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Upgrade-to-the-latest-MS-Windows-10-versio... . Can you try enabling the workaround and test?

The workaround was implanted in FortiOS 6.4.5 and is also present in 7.0.x:

# config vpn ssl settings
    set client-sigalgs no-rsa-pss
end

[littlecutTW]

Hi

I have read this Technical Tip and have set it up,but the problem still exists

[193:root:2f4d]allocSSLConn:307 sconn 0x7f9d92158100 (0:root)
[193:root:2f4d]disable RSA-PSS sigalgos.
[193:root:2f4d]SSL state:before SSL initialization (192.168.1.1)
[193:root:2f4d]SSL state:before SSL initialization:DH lib(192.168.1.1)
[193:root:2f4d]SSL_accept failed, 5:(null)
[193:root:2f4d]Destroy sconn 0x7f9d92158100, connSize=1. (root)
[193:root:2f4e]allocSSLConn:307 sconn 0x7f9d92158100 (0:root)
[193:root:2f4e]disable RSA-PSS sigalgos.

[srajeswaran]

Can you please share the complete debug after enabling no-rsa-pss

[littlecutTW]

Hi

The log I provided at the beginning was the log with the disable RSA_PSS.