Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sschuster
New Contributor II

ZTNA Access Denied with Forticlient on Fedora

Dear colleagues,

 

I don't get ZTNA running with Forticlient on Fedora Linux. I always get the massage

 

"ZTNA Access Denied
The page you requested has been blocked by a ZTNA restriction.

Details: Invalid ZTNA client certificate"

 

I tried Firefox, Chromium and Brave as Browsers but got the same result.

I rejoined the client to EMS, I reinstalled Forticlient but no change. Is there someone with the same problem or anybody who could help?

 

Forticlient 7.2.2.0753

EMS Forticloud

Fortigate 7.0.12

 

 

kind regards

stephan

1 Solution
sschuster
New Contributor II

At the end I could fix it by using another device. It was not working on my Lenovo T480 together with Linux even though it is working on T480 with windows. So just be informed that you may have trouble with some devices and Linux by using Forticlient which can maybe not be solved.

best

stephan

View solution in original post

13 REPLIES 13
dbu
Staff
Staff

Hi Setphan , 

 

In Windows, FortiClient automatically installs certificates into the certificate store. The certificate information in the store, such as certificate UID and SN, should match the information on FortiClient EMS and FortiGate.

 

To locate certificates on endpoint consult the vendor documentation.

 

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
spoojary
Staff
Staff

The error message you're seeing relates to the ZTNA client certificate. These certificates are crucial for ensuring a secure connection between the client and the server. If the certificate is expired, corrupted, or not trusted, it can lead to such issues.

  • Check if the ZTNA client certificate is still valid. Expired certificates will need to be renewed.
  • Ensure that the certificate is correctly installed and that the FortiClient software has the necessary permissions to access it.
  • Sometimes, it might help to manually import the certificate into the system's trusted certificate store.

 

Siddhanth Poojary
bpozdena_FTNT

Hi@sschuster,

 

If your FortiClient is connected to EMS, your client device should receive ZTNA client certificate.

 

On Fedora, you can verify if the certificate is imported into NSS shared DB with the bellow command:

certutil -d sql:$HOME/.pki/nssdb -Ln 'FortiClient ZTNA'

 

If you don't see any certificate there, maybe check if TPM is enabled in your BIOS (or VM config).

 

If you you can see the details of the ZTNA certificate, maybe just try closing ALL of your browser windows and then starting them again. Your browsers should prompt you to submit a ZTNA certificate when accessing ZTNA secured website.

 

If you get stuck, I'd suggest opening a TAC Support ticket.

HTH,
Boris
VinayHM
Staff
Staff

Hi @sschuster 

 

Can you please check, if the forticlient learned the tags from EMS that you are trying to access the service or application?

Regards,

Vinay HM
sschuster
New Contributor II

The Tags are displayed. The connection to EMS looks good.

sschuster
New Contributor II

Thank you for your Aswers so far.

certutil -d sql:$HOME/.pki/nssdb -Ln 'FortiClient ZTNA'

shows the certificate (but it takes really long time, >10sec?)  and the browsers are showing the popup to select the client cert.
Unfortunately I don't have logs about whats happening during that certificate check.
Fortigate is not logging this in the ZTNA logs, Forticlient seems to log nothing as well and the browser, started in terminal, does not show sothing as well.
The only thing I could find is 

{
    "request_time": "Mon Oct  9 13:40:59 2023 CEST",
    "receive_time": "Mon Oct  9 13:43:35 2023 CEST",
    "request_reason": "client certificate cannot be found on the system",
    "cert_serial": "[removed by me]",
    "ems_serial": "[removed by me]",
    "ems_address": "fct-[removed by me].forticlient-emsproxy.forticloud.com"
}


in /var/log/forticlient/ztna-cert.info.

 

best

stephan

VinayHM
Staff
Staff

Hi @sschuster 

 

Can you please give the output of the below command to the user?

diagnose endpoint record list

 

Is the EMS serial number and client cert matching on the Fortigate and EMS server?

 

Regards,

Vinay HM
sschuster
New Contributor II

The Fedora machine is not in the list. Checking Fortigate to find out why

sschuster
New Contributor II

The Fortigate shows only 3 offline users/machines but none of the devices currently as online displayed in EMS. I activated "share all Forticlients" in the "fabric devices" setting in EMS but without any effect. The Connection between Fortigate and EMS seems to be working. If I create a new ZTNA Tag, its showed on the Fortigate.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors