Certificate-based MFA on Fortigate

Export your ADCS root CA certificate (public key only)

Export the public certificate of your ADCS root CA from any domain workstation.

Find it in Certificates - Current User → Trusted Root Certification Authorities.

Export it as a .cer / Base-64 certificate (no private key).

Import the root CA into FortiGate

Import your CA root certificate in System → Certificates → Create/Import → CA Certificate.

For clarity, we recommend renaming the imported certificate (by default named Ca_Cert_X where X is a number) to a more meaningful name. To do so, open the FortiGate command line interface and enter the following commands:

config vpn certificate ca
rename Ca_Cert_X to ADCS_Cert

The certificate should then appear under its new name.

Create a user peer (PKI) that ties the cert to LDAP

You’ll reference this user peer from your SSL-VPN authentication rule.

Replace:

• ADCS_Cert with your imported CA name (the rename above).

• <LDAP_SERVER_NAME> with the FortiGate LDAP server object name from User & Authentication → LDAP Servers.

config user peer
    edit pki01
        set ca ADCS_Cert
        set ldap-server <LDAP_SERVER_NAME>
        set ldap-mode principal-name
    next
end

config user peer
    edit pki01
        set ca ADCS_Cert
        set mfa-mode subject-identity
        set mfa-server <LDAP_SERVER_NAME>
    next
end

Create an AD group for certificate users

To facilitate MFA deployment among your employees, we recommend creating a new Active Directory group. This will allow you to gradually migrate users from the "VPN without certificate" group to the "VPN with certificate" group. Create this new group in your Active Directory domain using the "Active Directory Users and Computers" tool. In the example below, we named it "NOMADE_CERT":

Create the FortiGate user group mapped to the AD group

Create a new User Group under User & Authentication → User Groups.

Set:

• Remote Server = your LDAP object

• Group Name = NOMADE_CERT (or your chosen AD group)

Map the user group to your SSL-VPN portal

In SSL-VPN Settings, map the new group to the portal you want.

Open the FortiGate CLI again and enter the following command:

conf vpn ssl settings
conf authentication-rule
show

The list of existing mappings should then be displayed, as in the example below:

You must now identify the newly created mapping. In this example, it is number 4, associated with the group NOMADE_CERT.

Enter the following commands (replace 4 with your mapping ID):

edit 4
set client-cert enable
set user-peer pki01
end
show

You should then see the updated list of mappings:

Users in the AD domain who belong to NOMADE_CERT must now present a valid user certificate to connect.

Test from FortiClient

On a domain-joined workstation, update the FortiClient VPN profile:

Select the certificate associated with your user (here "stoik_test") in the "Client Certificate" field: