SSL VPN client certificate CRL not working

[mrs]

Hi everyone,

I have a working ssl vpn with users authenticating against AD with LDAP, in addition, I've enabled "require client certificate" in vpn ssl settings and imported necessary root CA. Users with Forticlient specifing ldap username and password and selecting client certificate are correctly authenticated in VPN.

In addition to this I want to be able to revoke, if necessary, client certificates.

So I've imported the CRL in a following manner:

On a GUI, going to System -> Certificates, click on import CRL, choosing HTTP and providing URL.

After that I can see CRL appearing in the bottom of the list of certificates, and it's status is OK. CA name of this CRL matches CA name of the root CA certificate imported previously for client's certificate verification.

Cheking CRL dettails I can see the list of serial numbers of revoked certificates.

But...

For some reason, clients with revoked certificates are still able to log in.

Did I forgot something? How do I know if Fortigate realy checks this CRL and not ignore it?

Thanks

[mrs]

Hi, the problem has been solved upgrading from the current 5.4.1 version to 5.4.3, should be working with all subsequent versions. So it seems that it is 5.4.1 firmware bug.

[emnoc]

That's great to hear. You do known 5.4.3 is not the latest code in that train. v5.4.5 is currently available since june.