Troubleshooting certificates

There are times when there are problems with certificates — a certificate is seen as expired when its not, or it can’t be found. Often the problem is with a third party web site, and not FortiOS. However, some problems can be traced back to FortiOS such as DNS or routing issues.

Enable and disable SHA1 algorithm in SSH key exchanges

In order to investigate your security and conduct compliance testing, a global option allows you to enable/disable SHA1 algorithm in SSH key exchange. Note that, the algorithm is enabled by default.

Syntax

config system global set ssh-key-sha1 {enable | disable}

end

Certificate incorrectly reported as expired

Certificates often are issued for a set period of time such as a day or a month, depending on their intended use. This ensures everyone is using up-to-date certificates. It is also more difficult for hackers to steal and use old certificates.

Reasons a certificate may be reported as expired include:

It really has expired based on the “best before” date in the certificate l The FortiGate unit clock is not properly set. If the FortiGate clock is fast, it will see a certificate as expired before the expiry date is really here.
The requesting server clock is not properly set. A valid example is if your certificate is 2 hours from expiring, a server more than two time zones away would see the certificate as expired. Otherwise, if the server’s clock is set wrongly it will also have the same effect.

Troubleshooting

The certificate was revoked by the issuer before the expiry date. This may happen if the issuer believes a certificate was either stolen or misused. Its possible it is due to reasons on the issuer’s side, such as a system change or such. In either case it is best to contact the certificate issuer to determine what is happening and why.

A secure connection cannot be completed (certificate cannot be found)

Everyone who uses a browser has encountered a message such as This connection is untrusted. Normally when you try to connect securely to a web site, that web site will present its valid certificate to prove their identity is valid. When the web site’s certificate cannot be verified as valid, the message appears stating This connection is untrusted or something similar. If you usually connect to this web site without problems, this error could mean that someone is trying to impersonate or hijack the web site, and best practices dictates you not continue.

Reasons a web site’s certificate cannot be validated include:

The web site uses an unrecognized self-signed certificate. These are not secure because anyone can sign them. If you accept self-signed certificates you do so at your own risk. Best practices dictate that you must confirm the ID of the web site using some other method before you accept the certificate.
The certificate is valid for a different domain. A certificate is valid for a specific location, domain, or sub-section of a domain such as one certificate for example.com that is not valid for marketing.example.com. If you encounter this problem, contact the webmaster for the web site to inform them of the problem.
There is a DNS or routing problem. If the web site’s certificate cannot be verified, it will not be accepted. Generally to be verified, your system checks with the third party certificate signing authority to verify the certificate is valid. If you cannot reach that third party due to some DNS or routing error, the certificate will not be verified.
Firewall is blocking required ports. Ensure that any firewalls between the requesting computer and the web site allow the secure traffic through the firewall. Otherwise a hole must be opened to allow it through. This includes ports such as 443 (HTTPS) and 22 (SSH).

Online updates to certificates and CRLs

If you obtained your local or CA certificate using SCEP, you can configure online renewal of the certificate before it expires. Similarly, you can receive online updates to CRLs.

Local certificates

In the config vpn certificate local command, you can specify automatic certificate renewal. The relevant fields are:

scep-url <URL_str>	The URL of the SCEP server. This can be HTTP or HTTPS. The following options appear after you add the <URL_str>.
scep-password <password_str>	The password for the SCEP server.
auto-regenerate-days <days_ int>	How many days before expiry the FortiGate unit requests an updated local certificate. The default is 0, no auto-update.
auto-regenerate-days-warning <days_int>	How many days before local certificate expiry the FortiGate generates a warning message. The default is 0, no warning.

In this example, an updated certificate is requested three days before it expires.

config vpn certificate local edit mycert

Troubleshooting

set scep-url http://scep.example.com/scep set scep-server-password my_pass_123 set auto-regenerate-days 3 set auto-regenerate-days-warning 2

end

CA certificates

In the config vpn certificate ca command, you can specify automatic certificate renewal. The relevant fields are:

Variable Description

scep-url <URL_str> The URL of the SCEP server. This can be HTTP or HTTPS.

How many days before expiry the FortiGate unit requests an auto-update-days <days_int> updated CA certificate. The default is 0, no auto-update.

auto-update-days-warning How many days before CA certificate expiry the FortiGate

<days_int> generates a warning message. The default is 0,no warning.

In this example, an updated certificate is requested three days before it expires.

config vpn certificate ca edit mycert set scep-url http://scep.example.com/scep set auto-update-days 3 set auto-update-days-warning 2

end

Certificate revocation lists

If you obtained your CRL using SCEP, you can configure online updates to the CRL using the config vpn certificate crl command. The relevant fields are:

Variable	Description
http-url <http_url>	URL of the server used for automatic CRL certificate updates. This can be HTTP or HTTPS.
scep-cert <scep_certificate>	Local certificate used for SCEP communication for CRL autoupdate.
scep-url <scep_url>	URL of the SCEP CA server used for automatic CRL certificate updates. This can be HTTP or HTTPS.
update-interval <seconds>	How frequently, in seconds, the FortiGate unit checks for an updated CRL. Enter 0 to update the CRL only when it expires. Not available for http URLs.
update-vdom <update_vdom>	VDOM used to communicate with remote SCEP server for CRL auto-update.

In this example, an updated CRL is requested only when it expires.

Troubleshooting

config vpn certificate crl edit cert_crl set http-url http://scep.example.com/scep set scep-cert my-scep-cert

set scep-url http://scep.ca.example.com/scep set update-interval 0 set update-vdom root

end

Backing up and restoring local certificates

The FortiGate unit provides a way to export and import a server certificate and the FortiGate unit’s personal key through the CLI. If required (to restore the FortiGate unit configuration), you can import the exported file through the System > Certificates page of the web-based manager.

As an alternative, you can back up and restore the entire FortiGate configuration through the System Information widget on the Dashboard of the web-based manager. Look for [Backup] and [Restore] in the System Configuration row. The backup file is created in a FortiGate-proprietary format.

To export a server certificate and private key – CLI:

This procedure exports a server (local) certificate and private key together as a password protected PKCS12 file. The export file is created through a customer-supplied TFTP server. Ensure that your TFTP server is running and accessible to the FortiGate unit before you enter the command.

Connect to the FortiGate unit through the CLI.
Type the following command:

execute vpn certificate local export tftp <cert_name> <exp_filename> <tftp_ip>

where:

l <cert_name> is the name of the server certificate; typing ? displays a list of installed server certificates. l <exp_filename> is a name for the output file. l <tftp_ip> is the IP address assigned to the TFTP server host interface.

Move the output file from the TFTP server location to the management computer for future reference.

To import a server certificate and private key – web-based manager:

Go to System > Certificates and select Import.
In Type, select PKCS12 Certificate.
Select Browse. Browse to the location on the management computer where the exported file has been saved, select the file, and then select Open.
In the Password field, type the password needed to upload the exported file.
Select OK, and then select Return.

To import a server certificate and private key – CLI:

Connect to the FortiGate unit through the CLI.
Type the following command:

Configuring certificate-based authentication

execute vpn certificate local import tftp <file_name> <tftp_ip_address> <file_type> <Enter for ‘cer’>|<password for ‘p12’> For example:

execute vpn certificate local import tftp FGTF-extern.p12 10.1.100.253 p12 123456

To import separate server certificate and private key files – web-based manager

Use the following procedure to import a server certificate and the associated private key file when the server certificate request and private key were not generated by the FortiGate unit. The two files to import must be available on the management computer.

Go to System > Certificates and select Import.
In Type, select Certificate.
Select the Browse button beside the Certificate file Browse to the location on the management computer where the certificate file has been saved, select the file, and then select Open.
Select the Browse button beside the Key file Browse to the location on the management computer where the key file has been saved, select the file, and then select Open.
If required, in the Password field, type the associated password, and then select OK.
Select Return.

Fortinet GURU

FortiGate Guides and MORE!

Troubleshooting certificates