config system certificate certificate_verify
Use this command to manage certificate validation rules.
To be valid, a client certificate must meet the following criteria:
- Must not be expired or not yet valid
- Must not be revoked by either certificate revocation list (CRL) or, if enabled, online certificate status protocol (OCSP)
- Must be signed by a certificate authority (CA) whose certificate you have imported into the FortiADC appliance
- Must contain a CA field whose value matches a CA’s certificate
- Must contain an Issuer field whose value matches the Subject field in a CA’s certificate
Certificate validation rules specify the CA certificates to use when validating client certificates, and they specify a CRL and/or OCSP server, if any, to use for certificate revocation checking.
You select a certificate validation configuration object in the profile configuration for a virtual server. If the client presents an invalid certificate during the authentication phase of a SSL/TLS session initiation, the FortiADC system will not allow the connection.
Before you begin:
- You must have already created a CA group and OCSP or CRL configuration.
- You must have read-write permission for system settings.
Syntax
config system certificate certificate_verify
edit "verify"
set verify-depth <integer>
set customize-error-ignore <enable/disable>
set ca-ignore-errors <ca_errors>
set cert-ignore-errors <cert_errors>
config group_member
edit 1
set ca-certificate <ca>
set ocsp <ocsp rule>
set crl <crl rule>
next
end
next
end
|
verify-depth |
Specify the depth from the last intermediate CA to the root CA. |
|
customize-error-ignore |
Enable or disable "ignore errors". |
|
ca-ignore-errors |
Specify the errors on the CA to be ignored. Applicable only when "customize-error-ignore" is enabled. |
|
cert-ignore-errors |
Specify the errors on the certificate to be ignored. Applicable only when "customize-error-ignore" is enabled. |
Example
FortiADC-VM # config system certificate certificate_verify
FortiADC-VM (certificate_ve~i) # edit "verify"
FortiADC-VM (verify) # set verify-depth
<integer> Verify depth
FortiADC-VM (verify) # set customize-error-ignore
enable enable option
disable disable option
FortiADC-VM (verify) # set ca-ignore-errors
UNABLE_TO_GET_ISSUER_CERT OPENSSL 2
UNABLE_TO_GET_CRL OPENSSL 3
CERT_NOT_YET_VALID OPENSSL 9
CERT_HAS_EXPIRED OPENSSL 10
CRL_NOT_YET_VALID OPENSSL 11
CRL_HAS_EXPIRED OPENSSL 12
DEPTH_ZERO_SELF_SIGNED_CERT OPENSSL 18
SELF_SIGNED_CERT_IN_CHAIN OPENSSL 19
UNABLE_TO_GET_ISSUER_CERT_LOCALLY OPENSSL 20
UNABLE_TO_VERIFY_LEAF_SIGNATURE OPENSSL 21
CERT_CHAIN_TOO_LONG OPENSSL 22
INVALID_CA OPENSSL 24
INVALID_PURPOSE OPENSSL 26
CERT_UNTRUSTED OPENSSL 27
CERT_REJECTED OPENSSL 28
FortiADC-VM (verify) # set cert-ignore-errors
UNABLE_TO_GET_ISSUER_CERT OPENSSL 2
UNABLE_TO_GET_CRL OPENSSL 3
CERT_NOT_YET_VALID OPENSSL 9
CERT_HAS_EXPIRED OPENSSL 10
CRL_NOT_YET_VALID OPENSSL 11
CRL_HAS_EXPIRED OPENSSL 12
DEPTH_ZERO_SELF_SIGNED_CERT OPENSSL 18
SELF_SIGNED_CERT_IN_CHAIN OPENSSL 19
UNABLE_TO_GET_ISSUER_CERT_LOCALLY OPENSSL 20
UNABLE_TO_VERIFY_LEAF_SIGNATURE OPENSSL 21
CERT_CHAIN_TOO_LONG OPENSSL 22
INVALID_CA OPENSSL 24
INVALID_PURPOSE OPENSSL 26
CERT_UNTRUSTED OPENSSL 27
CERT_REJECTED OPENSSL 28
FortiADC-VM (verify) #