Certificate path configuration for automated certificate selection

The EMS administrator can configure a certificate location in a Remote Access profile for SSL and IPsec VPN. FortiClient (Android) automatically goes to the certificate location when doing the following:

• When selecting a certificate
• When the user clicks Connect to connect to SSL VPN

To configure certificate path for automated certificate selection:

1. In EMS, go to Endpoint Profiles > Remote Access.
2. Create a new profile or edit an existing one.
3. Click Add VPN Tunnel.
4. Do one of the following:
   1. For an SSL VPN tunnel, enable Require Certificate.

      To view and configure SSL VPN settings, you must enable SSL VPN visibility in System Settings > Feature Select. See Feature Select.

   2. For an IPsec VPN tunnel, from the Authentication Method dropdown list, select Smart Card Certificate or System Store Certificate.
5. In the Android Certificate Location field, enter the certificate location for the Android device. In this example, the location is certdir/. You should already have created this directory in the Android device internal storage. The certificate path can be only one level deep. For example, you could configure this field as Folder/clientcert.p12.
6. Connect FortiClient (Android) to EMS.
7. After FortiClient (Android) receives the configuration changes, do the one of the following:
   1. For SSL VPN, connect to VPN. Clicking Connect automatically navigates to certdir, the configured certificate location. Clicking the certificate options in Settings for the VPN tunnel also goes to sslcertdir.

      

   2. For IPsec VPN, go to the tunnel, then Settings > Server settings > Certificate. FortiClient (Android) automatically navigates to certdir, the configured certificate location. Select the certificate, enter the password, then click Connect. The tunnel establishes successfully.