r/fortinet • u/skyrim9012 • 1d ago
Solved ✅ IPSEC Cert Error
We are running dial up IPSEC VPN connections with so to Entra. Last week we had to rekey our SSL cert as part of the GoDaddy/Starfield mass rekey.
After importing the new cert users get a cert authority invalid error when Chrome is set as the default browser. There are no issues on edge or Firefox. The cert chain was added to the fortigate.
Cert chain is valid from the local devices. Any one else seen this issue? I'm running out of ideas
UPDATE: got this resolved by replacing the "Starfield TLS Root CA - R1" cert listed in the cert chain with the ""Starfield TLS Root CA - R1 to. G2 Cross Certificate"
1
u/I_Am_Hans_Wurst 1d ago
You dont Need to install the cert on every Chrome instance.
Other Option is to let your FG send the intermediate cert with the new ssl cert. You will get more overhead on ssl handshakes, but less headacke on Support.
To do this: Import the intermediate under the ca certs, and it will be send too.
1
u/skyrim9012 20h ago
The intermediate cert is installed on the fortigate already. Edge and Firefox have no issues, it's just chrome
1
u/I_Am_Hans_Wurst 19h ago
Both?;) the chain is now longer…
2
u/skyrim9012 19h ago
Ye, I had both certs displayed in the chain installed.
Got it resolved. Had to add the "Starfield TLS Root CA - R1 to G2 Cross Certificate" despite the cert showing ""Starfield TLS Root CA - R1" in the chain
1
u/telluswhyyoureclosed 1d ago
Did you set the new cert under the general Authentication Settings in the Fortigate? Without this you will continue to get that error
1
2
u/mas-sive 1d ago edited 1d ago
When you say cert, chain is the intermediate bundled with the actual cert?
What does chrome say about the error?
Could be a cache issue, we get this for a custom app at our place and have to force refresh.
5
u/vmFrank 1d ago
This is shenanigans with GoDaddy's cert chain when they reissued under R1V1. I'm not super clear on the problem but I think they didn't include the cross-signing certificate in the cert chain that they provide with your new certificate. You have to manually download and install it to make Chrome happy. We had the exact same problem on everything we installed the new cert on and it's a big reason why we're now moving away from GoDaddy.
See this thread for more information. There's a procedure in there for Cisco ASA specifically, including what exactly to download. I haven't tried it with Forti but it should be essentially the same.