Strong authentication with security certificates
The FortiGate unit supports strong (two-factor) authentication through X.509 security certificates (version 1 or 3). The FortiGate unit can require clients to authenticate using a certificate. Similarly, the client can require the FortiGate unit to authenticate using a certificate.
For information about obtaining and installing certificates, see the Authentication chapter of The Handbook.
You can select the Require Client Certificate option in SSL VPN config so that clients must authenticate using certificates. The client browser must have a local certificate installed, and the FortiGate unit must have the corresponding CA certificate installed.
When the remote client initiates a connection, the FortiGate unit prompts the client browser for its client-side certificate as part of the authentication process.
To require client authentication by security certificates - web-based manager
1. Go to VPN > SSL > Config.
2. Select Require Client Certificate.
3. Select Apply.
To require client authentication by security certificates - CLI
config vpn ssl settings
set reqclientcert enable
end
If your SSL VPN clients require strong authentication, the FortiGate unit must offer a CA certificate that the client browser has installed.
In the FortiGate unit SSL VPN settings, you can select which certificate the FortiGate offers to authenticate itself. By default, the FortiGate unit offers its factory installed (self‑signed) certificate from Fortinet to remote clients when they connect.
To enable FortiGate unit authentication by certificate - web-based manager
1. Go to VPN > SSL > Config.
2. From the Server Certificate list, select the certificate that the FortiGate unit uses to identify itself to SSL VPN clients.
3. Select Apply.
To enable FortiGate unit authentication by certificate - CLI
For example, to use the example_cert certificate
config vpn ssl settings
set servercert example_cert
end
| FortiOS will check the server certificate to verify that the certificate is valid. Only valid server certificates should be used. |