config system certificate certificate_verify
Use this command to manage certificate validation rules.
FortiADC uses certificate verification objects to enforce trust during SSL/TLS handshakes. These objects define the rules for validating certificates presented by external clients (in Client SSL profiles) or by backend servers (in Real Server SSL profiles). When enabled, FortiADC evaluates the presented certificate against the configured trust anchors and revocation sources before allowing the session to proceed.
A certificate verify object specifies:
-
Trusted Certificate Authorities (CAs): Certificates must chain to an imported and trusted CA.
-
Revocation sources: One or more CRL (Certificate Revocation List) files and/or an OCSP (Online Certificate Status Protocol) responder can be configured to check whether a certificate has been revoked. Multiple CRL files can be associated with the same verification object.
-
Advanced options: Such as advertising trusted CAs to clients when requesting certificates, or controlling the frequency of client authentication checks (once per session or on every reuse).
For a certificate to be considered valid, it must:
-
Not be expired or not yet valid.
-
Not be revoked according to the configured CRL or OCSP.
-
Be signed by a CA certificate imported into FortiADC.
If any of these conditions fail, FortiADC denies the connection during the TLS handshake.
Before configuring certificate verification, ensure you have:
-
Read-Write permission for System settings.
-
Imported the required CA certificates, CRLs, or OCSP configurations into the system.
Once created, certificate verify objects can be applied in Client SSL profiles or Real Server SSL profiles, depending on the direction of validation required.
|
Certificate verification objects with Client Authentication enabled can only be applied to Client SSL profiles. If applied to a Real Server SSL profile, the setting is ignored, since FortiADC does not validate client certificates when acting as a TLS client. |
Syntax
config system certificate certificate_verify
edit "verify"
set verify-depth <integer>
set client-authentication {enable/disable}
set client-auth-frequency {once|always}
set customize-error-ignore {enable/disable}
set ca-ignore-errors <ca_errors>
set cert-ignore-errors <cert_errors>
config group_member
edit 1
set ca-certificate <ca>
set advertise-certificate-authority {enable/disable}
set ocsp <ocsp rule>
set crl <crl rule>
next
end
next
end
|
verify-depth |
Specify the depth from the last intermediate CA to the root CA. Default: 1, Range: 0-255. |
|
client-authentication |
Enable or disable mutual TLS client authentication. When disabled (default), FortiADC accepts TLS sessions without requesting client certificates. When enabled, FortiADC requires and validates client certificates as part of the handshake, allowing advanced verification options to apply. |
|
client-auth-frequency |
Available when client-authentication is enabled. Determines how often FortiADC validates the client certificate for a session.
|
|
customize-error-ignore |
Enable or disable customize-error-ignore. The option is disabled by default. When enabled, you are required to select the ca-ignore-errors and cert-ignore-errors, as described below. |
|
ca-ignore-errors |
When customize-error-ignore is enabled, the following options become available for you to choose from:
Note: If
|
|
cert-ignore-errors |
When customize-error-ignore is enabled, the following options become available for you to choose from:
Note: If customize-error-ignore is disabled (by default), the CLI shows the following:
|
|
config group_member |
|
|
ca-certificate |
Required. Select a CA (Certificate Authority) object that represents the trusted issuer of client certificates. |
|
advertise-certificate-authority |
Enable to include the configured CA list in the TLS handshake when FortiADC requests a client certificate. This ensures that clients present certificates issued by approved authorities, reducing the risk of untrusted or unexpected CAs being accepted. This is enabled by default. |
|
ocsp |
Optional. Select a CRL (Certificate Revocation List) object to reject certificates explicitly revoked by the issuing CA. |
|
crl |
Optional. Select an OCSP (Online Certificate Status Protocol) responder to perform real-time certificate revocation checks. |
Example
FortiADC-VM # config system certificate certificate_verify
FortiADC-VM (certificate_ve~i) # edit "verify"
FortiADC-VM (verify) # set verify-depth
<integer> Verify depth
FortiADC-VM (verify) # set customize-error-ignore
enable enable option
disable disable option
FortiADC-VM (verify) # set ca-ignore-errors
UNABLE_TO_GET_ISSUER_CERT OPENSSL 2
UNABLE_TO_GET_CRL OPENSSL 3
CERT_NOT_YET_VALID OPENSSL 9
CERT_HAS_EXPIRED OPENSSL 10
CRL_NOT_YET_VALID OPENSSL 11
CRL_HAS_EXPIRED OPENSSL 12
DEPTH_ZERO_SELF_SIGNED_CERT OPENSSL 18
SELF_SIGNED_CERT_IN_CHAIN OPENSSL 19
UNABLE_TO_GET_ISSUER_CERT_LOCALLY OPENSSL 20
UNABLE_TO_VERIFY_LEAF_SIGNATURE OPENSSL 21
CERT_CHAIN_TOO_LONG OPENSSL 22
INVALID_CA OPENSSL 24
INVALID_PURPOSE OPENSSL 26
CERT_UNTRUSTED OPENSSL 27
CERT_REJECTED OPENSSL 28
FortiADC-VM (verify) # set cert-ignore-errors
UNABLE_TO_GET_ISSUER_CERT OPENSSL 2
UNABLE_TO_GET_CRL OPENSSL 3
CERT_NOT_YET_VALID OPENSSL 9
CERT_HAS_EXPIRED OPENSSL 10
CRL_NOT_YET_VALID OPENSSL 11
CRL_HAS_EXPIRED OPENSSL 12
DEPTH_ZERO_SELF_SIGNED_CERT OPENSSL 18
SELF_SIGNED_CERT_IN_CHAIN OPENSSL 19
UNABLE_TO_GET_ISSUER_CERT_LOCALLY OPENSSL 20
UNABLE_TO_VERIFY_LEAF_SIGNATURE OPENSSL 21
CERT_CHAIN_TOO_LONG OPENSSL 22
INVALID_CA OPENSSL 24
INVALID_PURPOSE OPENSSL 26
CERT_UNTRUSTED OPENSSL 27
CERT_REJECTED OPENSSL 28
FortiADC-VM (verify) #