Configuring certificate authentication for a VPN
With peer certificates loaded, peer users and peer groups defined, you can configure your VPN to authenticate users by certificate.
To enable access for a specific certificate holder or a group of certificate holders
1. At the FortiGate VPN server, go to VPN > IPsec > Tunnels and create the new custom tunnel or edit an existing tunnel.
2. Edit the Phase 1 Proposal (if it is not available, you may need to click the Convert to Custom Tunnel button).
3. From the Authentication Method list, select RSA Signature.
4. From the Certificate Name list, select the name of the server certificate that the FortiGate unit will use to authenticate itself to the remote peer or dialup client
5. Under Peer Options, select one of these options:
• To accept a specific certificate holder, select
Accept this peer certificate only and select the name of the certificate that belongs to the remote peer or dialup client. The certificate DN must be added to the FortiGate configuration through CLI commands before it can be selected here. See
“Before you begin”.
• To accept dialup clients who are members of a certificate group, select
Accept this peer certificate group only and select the name of the group. The group must be added to the FortiGate configuration through CLI commands before it can be selected here. See
“Before you begin”.
6. If you want the FortiGate VPN server to supply the DN of a local server certificate for authentication purposes, select Advanced and then from the Local ID list, select the DN of the certificate that the FortiGate VPN server is to use.
7. Select OK.