FortiGate IPsec Remote Access VPN with Computer Certificate Pinning

By Manny Fernandez

March 31, 2026

FortiGate IPsec Remote Access VPN with Computer Certificate Pinning

Years back, I wrote an article about certificate pinning. Although I had updated that one, from an even older one, I decided it needed a makeover. We will be using a FortiGate 120G In my lab, with FortiAuthenticator 8.0.2 and macOS Tahoe 26.4. FortiAuthenticator will be our CA, FortiGate will be our VPN termination point and the macOS will be the client running FortiClient 7.4.4.

The use case is as follows. You have a customer that wants to ensure that ONLY devices owned by them, are allowed to connect to the VPN. We will explore a couple of options here. One of them will be certificate-based with machine certificate and the other will be user-based certificates with an LDAP back end for EAP authentication (XAuth is deprecated when using IKEv2.).

Lets get started.

FortiAuthenticator: Creating certificates

Create CA Server

We are going to need to generate three certificates, a CA certificate, a certificate for the FortiGate and a certificate for the workstation. We will do this in FortiAuthenticator

Go to Certificate Management — > Certificate Authority — > Loca CAs.

Now Create New

Fill out the information based on your environment

Name of the CA server
Ensure it is Root CA (That is the default)
Fill in the pertinent information
Change the key length and hashing algorithm (see below)

4096‑bit RSA and SHA‑512 provide higher theoretical security margins than 2048‑bit RSA and SHA‑256, but both 2048/SHA‑256 and 4096/SHA‑512 are currently considered secure for typical enterprise lifetimes.

4096‑bit RSA operations are significantly slower and heavier on CPU than 2048‑bit, which can impact TLS handshakes or large‑scale auth workloads on your FortiAuthenticator and clients.

Once you create the CA, you will need to export the cert

Creating the FortiGate Certificate

Next we will create a certificate for the FortiGate.

Go to Certificate Management — > End Entities — > Users

Ensure that the CA drop down shows the correct CA server.

Creating the Machine Certificate

Now we will create the machine certificate

Go to Create New and fill in the information. Ensure you add a UPN under the Other Subject Alternative Name

Export this certificate and key as well.

Installing the Certificates on the FortiGate

Installing on the FortiGate

There are two certificates you need to install on the FortiGate; the Local Certificate (in my example MonkeyGate) and the CA certificate.

Local Certificate

Installing the CA as a remote CA certificate

I recommend you change the name of the certificate by running the following command

config vpn certificate ca
rename %current-name% to %new-name%
end

You can do the same for the Local, CA, and Remote.

Once completed, you should have 2 certificates, One under Remote CA Certificates and the other under Local Certificate.

Peers and Peer-Groups

We are now going to configure Peers and Peer-Groups.

You want to make sure you set ca to the CA certificate you imported.

You will need a peergrp even if you only have 1 user because the VPN config will only use a peeergrp.

config user peergrp
edit "cert-pin"
set member "manny_vpn" "c_manny_mac4"
next
end

Configure VPN

In your operational remote access VPN , make the following changes. If you need to set up the remote access VPN, see this article. Although it is for SAML, I walk you through the configuration.

You want to make sure you use the Certificate Name of the Certificate you imported above. On Accepted Peer ID choose Peer Certificate group

Installing Certificate on macOS

With exported certificates you will need to import the certificates on the macOS device as well as any device you might have.

Copy the files to the machine in question. If you want to make the certificates non-exportable, which I highly recommend especially with the use case described, import the certificate from the command line.

security import /path/to/cert.p12 -k ~/Library/Keychains/login.keychain -x

Alternatively, you can import the certificate by double-clicking the file while on the macOS device.

Installing Certificate on Windows

You can either launch MMC from the Windows device, or you can double click on the certificate file itself. If the certificate is not installed, it will show the Install Certificate button on the bottom.

When you install the various certificates, you will need to put the CA certificate in the Trusted Root Certificate Authorities store.

The FortiGate certificate and the device certificate you be installed in the Personal store.

FortiClient Setup – Windows

On you FortiClient VPN either create a new connection or modify the existing,

Under the Authentication Method choose X.509 Certificate

Under Client Certificate choose your user certificate.

Authentication EAP in this configuration should be set to Disable

FortiClient Setup – macOS

On macOS, when you attempt the first connection using the certificates, it will prompt you for the administrative password.

You can choose Always Allow or Allow

In macOS, choosing Always Allow grants the app permanent access to a certificate in your keychain, suppressing future pop-ups until the certificate expires or is revoked. Selecting Allow grants temporary access, meaning the prompt will reappear, often on every app launch or network reconnection, which can become frequent with VPNs.

Next I will integrate LDAP as an additional authentication using EAP since X-Auth is deprecated when using IKE v2

Hope this helps.

FortiGate IPsec Remote Access VPN with Computer Certificate Pinning

FortiAuthenticator: Creating certificates

Create CA Server

Creating the FortiGate Certificate

Creating the Machine Certificate

Installing the Certificates on the FortiGate

Installing on the FortiGate

Local Certificate

Installing the CA as a remote CA certificate

Peers and Peer-Groups

Configure VPN

Installing Certificate on macOS

Installing Certificate on Windows

FortiClient Setup – Windows

FortiClient Setup – macOS

Recent posts