Hello,
short question how to revoke single certificate used for certificate authenticated ipsec vpn?
I've used openssl to generate CA and user certificates, lets say one laptop was stolen, how to revoke certificate to block connections?
There is an option to import CRL... but what next? :)
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
use your CA and revoke that cert. Make the CA list it in CRL list.
Check the CRL list on your CA, or revoked cert, and look for CRLDistibutionPoint URL.
Then you can either export CRL on CA and import it into FortiOS, or set FortiGate to periodically check and refresh CRL list from CA, for example via HTTP.
In FortiOS use GUI or CLI to import, or automatically keep latest CRL.
From CLI point of view it might look like this:
config certificate crl edit "CA.crl" set http-url "http://yourCA.example.com/cert/crl/example.rootCA.crl" set update-interval 300 next end
Debug: command bellow, or 'show full certificate crl', or in GUI show or download the CRL list to see revoked certs.
Be aware that GUI overview just shows [strike]last[/strike] first 100 revoked certs, so if the list is expected to be longer then download what FortiGate got from CRL Distribution point or simply download the list to you by following that link and you should be offered with the CRL list file.
diag debug application crl-upodate -1
diag debug enable
To the actual openSSL cert handling . .how about Google something like this from StackOverflow ?
https://stackoverflow.com...t-have-the-certificate
Regards,
Tomas
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Thanks Im gonna do some test this weekend :)
Hi,
How was your test?
I'm facing a similar issue not being able to revoke certificates used by SSL VPN clients connecting to Fortigate.
I have configured HTTP method of CRL update described above, all seems to be functioning, CRL updates correctly, I can see SN's of revoked certs in the list, but then clients with revoked certificates are able to connect anyway.
Sorry didn't had time to do this.
ATM my FG is broken - after update to 5.6.1 my ipsec vpn connection stopped working. Im gonna stick with OpenVPN I've used so far. IMO Fortinet vpn client is worst client I've seen so far - no CLI and many unnecessary stuff that cant be disabled. And I was looking forward to get rid of OpenVPN...
Which client operating system do you use?
At least IPSec VPN without FortiClient is an option for all client operating systems, this is built in to windows, mac os and linux.
For Linux clients there are also some open source third party clients for the ssl-vpn.
NSE 4/5/7
W10 mostly and some W7 - I consider built in ipsec vpn as last resort.
Which version of fortios did you use before the upgrade to 5.6.1?
Which version of forticlient is installed to your clients?
NSE 4/5/7
before upgrade it was 5.6.0
FC is in version 5.6.0.1075
tested this from two ISP - same problem:
2017-08-15 23:27:05 Debug VPN phase2 negotiation failed due to time up. ec30eeb57790b806:dca3d81ac305e3cb:0000ab8f
2017-08-15 23:27:05 Warning VPN id=96562 msg="locip=10...... locport=500 remip=238...... remport=500 outif=0 vpntunnel=wiog status=negotiate_error No response from the peer, phase2 retransmit reaches maximum count..." vpntunnel=wiog vpntype=ipsec
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1545 | |
1030 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.