Setting up SSL VPN with certificate authentication on FortiGate

By IPWOX · Updated 23 July 2026

FortiGateSSL VPN

Description	Step-by-step guide to configuring SSL VPN with certificate-based authentication on FortiGate firewalls, replacing password-only access for remote users, with CLI configuration and verification.
Scope	FortiGate running FortiOS 7.2 or 7.4. Examples use FortiOS 7.4.3. Applicable to all FortiGate models.
Solution	Follow the numbered steps below. GUI paths are shown as breadcrumbs; equivalent CLI configuration is provided for each stage.

Assumptions

The FortiGate has a working internet-facing interface (wan1 in this example).
A certificate authority (internal CA or public) is available to issue client certificates.
Administrative access to the FortiGate GUI and CLI.

Configuration steps

[ Screenshot: Certificate import dialogue (System → Certificates → Import) ]

Screenshot: Certificate import dialogue (System → Certificates → Import)

:::

Import the CA certificate. Go to System → Certificates → Import → CA Certificate and upload the CA certificate used to sign your client certificates.
Verify the certificate appears under the Remote CA Certificate section as CA_Cert_1. Rename it in the CLI for clarity:
```
config vpn certificate ca
    rename CA_Cert_1 to IPWOX-Client-CA
end
```

Create the user peer group and bind certificate authentication:

config user peer
    edit "vpn-cert-users"
        set ca "IPWOX-Client-CA"
    next
end

Configure the SSL VPN settings. Go to VPN → SSL-VPN Settings, set the listening interface and port, and select the server certificate.
Create the firewall policy allowing SSL VPN traffic to the internal network, and apply your standard security profiles (AV, IPS, web filtering).

Note: avoid port 443 if the same interface publishes other HTTPS services; 10443 is a common alternative.

Verification

Confirm connected clients and their authentication method:

get vpn ssl monitor
diagnose vpn ssl list

A successful certificate login shows the peer name against the session, with no password fallback recorded in the event log.

Common issues

Certificate not offered by the client — confirm the client certificate (with private key) is installed in the user store, not the machine store.
“Permission denied” at login — the peer CA does not match the CA that signed the client certificate.

Need a hand with FortiGate or wider network security?

IPWOX designs, remediates and supports enterprise networks across Fortinet, Palo Alto, Cisco and Check Point. Tell us about your estate and we’ll tell you what we’d do with it.

Talk to IPWOX