revoke certificate (ipsec vpn)

[yi]

Hello,

short question how to revoke single certificate used for certificate authenticated ipsec vpn?

I've used openssl to generate CA and user certificates, lets say one laptop was stolen, how to revoke certificate to block connections?

There is an option to import CRL... but what next? :)

[xsilver_FTNT]

Hi,

use your CA and revoke that cert. Make the CA list it in CRL list.

Check the CRL list on your CA, or revoked cert, and look for CRLDistibutionPoint URL.

Then you can either export CRL on CA and import it into FortiOS, or set FortiGate to periodically check and refresh CRL list from CA, for example via HTTP.

In FortiOS use GUI or CLI to import, or automatically keep latest CRL.

From CLI point of view it might look like this:

config certificate crl     edit "CA.crl"         set http-url "http://yourCA.example.com/cert/crl/example.rootCA.crl"         set update-interval 300     next end

Debug: command bellow, or 'show full certificate crl', or in GUI show or download the CRL list to see revoked certs.

Be aware that GUI overview just shows [strike]last[/strike] first 100 revoked certs, so if the list is expected to be longer then download what FortiGate got from CRL Distribution point or simply download the list to you by following that link and you should be offered with the CRL list file.

diag debug application crl-upodate -1

diag debug enable

To the actual openSSL cert handling . .how about Google something like this from StackOverflow ?

https://stackoverflow.com...t-have-the-certificate

Regards,

Tomas

[yi]

Thanks Im gonna do some test this weekend :)

[mrs]

Hi,

How was your test?

I'm facing a similar issue not being able to revoke certificates used by SSL VPN clients connecting to Fortigate.

I have configured HTTP method of CRL update described above, all seems to be functioning, CRL updates correctly, I can see SN's of revoked certs in the list, but then clients with revoked certificates are able to connect anyway.

[yi]

Sorry didn't had time to do this.

ATM my FG is broken - after update to 5.6.1 my ipsec vpn connection stopped working. Im gonna stick with OpenVPN I've used so far. IMO Fortinet vpn client is worst client I've seen so far - no CLI and many unnecessary stuff that cant be disabled. And I was looking forward to get rid of OpenVPN...

[bommi]

Which client operating system do you use?

At least IPSec VPN without FortiClient is an option for all client operating systems, this is built in to windows, mac os and linux.

For Linux clients there are also some open source third party clients for the ssl-vpn.

[yi]

W10 mostly and some W7 - I consider built in ipsec vpn as last resort.

[bommi]

Which version of fortios did you use before the upgrade to 5.6.1?

Which version of forticlient is installed to your clients?

[yi]

before upgrade it was 5.6.0

FC is in version 5.6.0.1075

tested this from two ISP - same problem:

2017-08-15 23:27:05 Debug VPN phase2 negotiation failed due to time up. ec30eeb57790b806:dca3d81ac305e3cb:0000ab8f
2017-08-15 23:27:05 Warning VPN id=96562 msg="locip=10...... locport=500 remip=238...... remport=500 outif=0 vpntunnel=wiog status=negotiate_error No response from the peer, phase2 retransmit reaches maximum count..." vpntunnel=wiog vpntype=ipsec