Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
manuelq
New Contributor

Fortigate not allowing SSL VPN with new Certificate Authority

We  utilize a sslvpn with an external issued CA, the CA expired recently and we received a new CA and added it to the Fortigate - the sudo global CA details liste the new CA as the source - but clients get "permission denied" and the log on the client show SSL Unknown 9 Failed to log into fortigate -131. 

The same new CA and certs work on a cisco vpn tool for verification. 

3 REPLIES 3
Anthony_E
Community Manager
Community Manager

Hello Manuel,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello Manuel,

 

I have found this document:

 

https://docs.fortinet.com/document/fortigate/6.2.11/cookbook/266506/ssl-vpn-with-certificate-authent...

 

Could you please tell me if it helped?

 

Regards,

Anthony-Fortinet Community Team.
Markus_M
Staff
Staff

Hi Manuel,

 

you will need to see whether the certificates are installed where they belong. There will be one node sending a certificate, the other will have to verify it. Verification is done with the CA cert. If there is an intermediate CA cert, this is to be included.

 

Making a guess on your configuration, standard SSLVPN: The client is only receiving a server certificate (FortiGate has this newly issued Server certificate by your new CA set in the SSLVPN settings), The client requires having the root CA installed. Do make sure you have a new server certificate issued by your new CA. The old certificate cannot be used anymore as the certificate chain verification will not work out.

If there is an intermediate CA, make sure this is ALSO installed in the FortiGate.

To install the rootCA in this mentioned case on the FortiGate is not required.

 

If your FortiGate has the option set of requiring a client certificate, then additionally to the process above, the client will send a client certificate to the FortiGate which then also needs to verify it and have the rootCA installed and the intermediate, if any.

 

More about certificates:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-TLS-and-the-use-of-Digital-Certificates/ta...

 

Best regards,

 

Markus

Labels
Top Kudoed Authors