Hot!revoke certificate (ipsec vpn)

Author
yi
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/07/02 08:16:06
  • Status: offline
2017/07/19 14:35:02 (permalink)
0

revoke certificate (ipsec vpn)

Hello,
 
short question how to revoke single certificate used for certificate authenticated ipsec vpn?
I've used openssl to generate CA and user certificates, lets say one laptop was stolen, how to revoke certificate to block connections?
 
There is an option to import CRL... but what next? :)
#1

8 Replies Related Threads

    xsilver_FTNT
    Platinum Member
    • Total Posts : 209
    • Scores: 42
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/07/20 07:19:31 (permalink)
    5 (2)
    Hi,
     
    use your CA and revoke that cert. Make the CA list it in CRL list.
    Check the CRL list on your CA, or revoked cert, and look for CRLDistibutionPoint URL.
    Then you can either export CRL on CA and import it into FortiOS, or set FortiGate to periodically check and refresh CRL list from CA, for example via HTTP.
    In FortiOS use GUI or CLI to import, or automatically keep latest CRL.
    From CLI point of view it might look like this:
     
    config certificate crl
        edit "CA.crl"
            set http-url "http://yourCA.example.com/cert/crl/example.rootCA.crl"
            set update-interval 300
        next
    end


    Debug: command bellow, or 'show full certificate crl', or in GUI show or download the CRL list to see revoked certs.
    Be aware that GUI overview just shows last first 100 revoked certs, so if the list is expected to be longer then download what FortiGate got from CRL Distribution point or simply download the list to you by following that link and you should be offered with the CRL list file.
     
    diag debug application crl-upodate -1
    diag debug enable
     
    To the actual openSSL cert handling . .how about Google something like this from StackOverflow ?
    https://stackoverflow.com...t-have-the-certificate
     
    Regards,
    Tomas
    post edited by xsilver_FTNT - 2017/07/21 08:41:03

    Kind Regards,
    Tomas
    #2
    yi
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/07/02 08:16:06
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/07/21 04:16:18 (permalink)
    0
    Thanks Im gonna do some test this weekend :)
    #3
    mrs
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/08/10 09:32:17
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/08/13 22:26:00 (permalink)
    0
    Hi,
     
    How was your test?
    I'm facing a similar issue not being able to revoke certificates used by SSL VPN clients connecting to Fortigate.
    I have configured HTTP method of CRL update described above, all seems to be functioning, CRL updates correctly, I can see SN's of revoked certs in the list, but then clients with revoked certificates are able to connect anyway.
    #4
    yi
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/07/02 08:16:06
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/08/15 08:51:02 (permalink)
    0
    Sorry didn't had time to do this.
     
    ATM my FG is broken - after update to 5.6.1 my ipsec vpn connection stopped working. Im gonna stick with OpenVPN I've used so far. IMO Fortinet vpn client is worst client I've seen so far - no CLI and many unnecessary stuff that cant be disabled. And I was looking forward to get rid of OpenVPN...
     
     
    #5
    bommi
    Silver Member
    • Total Posts : 61
    • Scores: 3
    • Reward points: 0
    • Joined: 2016/08/03 03:42:49
    • Location: Germany
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/08/15 13:41:32 (permalink)
    0
    Which client operating system do you use?
    At least IPSec VPN without FortiClient is an option for all client operating systems, this is built in to windows, mac os and linux.
    For Linux clients there are also some open source third party clients for the ssl-vpn.
    post edited by bommi - 2017/08/15 13:51:31
    #6
    yi
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/07/02 08:16:06
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/08/15 13:57:18 (permalink)
    0
    W10 mostly and some W7 - I consider built in ipsec vpn as last resort.
     
     
    #7
    bommi
    Silver Member
    • Total Posts : 61
    • Scores: 3
    • Reward points: 0
    • Joined: 2016/08/03 03:42:49
    • Location: Germany
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/08/15 14:11:07 (permalink)
    0
    Which version of fortios did you use before the upgrade to 5.6.1?
    Which version of forticlient is installed to your clients?
    #8
    yi
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/07/02 08:16:06
    • Status: offline
    Re: revoke certificate (ipsec vpn) 2017/08/15 14:34:20 (permalink)
    0
    before upgrade it was 5.6.0
    FC is in version 5.6.0.1075
    tested this from two ISP - same problem:
    2017-08-15 23:27:05 Debug VPN phase2 negotiation failed due to time up. ec30eeb57790b806:dca3d81ac305e3cb:0000ab8f
    2017-08-15 23:27:05 Warning VPN id=96562 msg="locip=10...... locport=500 remip=238...... remport=500 outif=0 vpntunnel=wiog status=negotiate_error No response from the peer, phase2 retransmit reaches maximum count..." vpntunnel=wiog vpntype=ipsec

     
    #9
    Jump to:
    © 2017 APG vNext Commercial Version 5.5