Tag Archives: ssl

Fixing SAML Authentication Failure After FortiGate Upgrade with Microsoft Entra ID – Firewall Authentication Failed

A quick post on what broke after a FortiGate firmware upgrade—and the one setting that fixed it.

After upgrading a FortiGate firewall to the latest firmware, I ran into an unexpected problem:
SAML authentication suddenly stopped working for users signing in via
Microsoft Entra ID (formerly Azure AD). The configuration looked intact—certificates were present,
the SAML setup was unchanged—yet logins kept failing.
Forticlient users, will get Firewall Authentication Failed



It wasn’t a lost configuration or a certificate mismatch. It turned out to be a change in
how SAML assertions are validated in the newest FortiGate versions when
Microsoft Entra ID is the Identity Provider (IdP).

The Root Cause
The latest FortiGate firmware expects the IdP to sign both the SAML response and the SAML assertion.
If your Entra ID configuration only signs the response (which used to be sufficient), authentication will fail
after the upgrade.

The Fix (Microsoft Entra ID setting)

  • Open the Microsoft Entra admin center and go to your Enterprise application for FortiGate.
  • Navigate to Single sign-on → SAML Certificates → SAML Signing Certificate → Edit.
  • Under Signing option, select: Sign SAML response and assertion.
  • Save the change and test authentication again.
  • Once this option was enabled, users were able to authenticate successfully again.

    Why This Matters
    Requiring signatures on both the response and the assertion strengthens the integrity of the SAML flow:
    FortiGate can verify not only the envelope (response) but also the identity claims (assertion).
    This improves security, but it may catch existing deployments by surprise after an upgrade.

    Takeaway

    • If SAML breaks after a FortiGate firmware upgrade with Entra ID as IdP, don’t assume your configuration is lost.
    • Enable “Sign SAML response and assertion” in Microsoft Entra ID for the affected application.
    • Re-test sign-in—authentication should start working immediately.

    Reference
    Fortinet community article on post-upgrade SAML issues:
    Troubleshooting Tip – SAML Authentication fails after firmware upgrade

    Tip: If you manage multiple FortiGate clusters, note this requirement in your upgrade checklist to avoid surprise outages.

    Update Service with new SSL certificate

    Some service SSL certificate is adminstrate though netsh

    start netsh, though a CMD, with just type: netsh

    If you then type: http show sslcert, you can see SSL certificate information:

    netsh>http show sslcert
    SSL Certificate bindings:
    -------------------------
    IP:port                      : 0.0.0.0:443
    Certificate Hash             : 5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5
    Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
    Certificate Store Name       : (null)
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled

    So to update this ssl certificate you type:

    netsh>http add sslcert ipport=0.0.0.0:443 certhash=5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5 appid={4dc3e181-e14b-4a21-b022-59fc669b0914}

    Where 5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5 is the thumbprint of the SSL certificate. The thumbprint of a certificate can be found by running this powershell commands:

    Get-ChildItem -path cert:\LocalMachine\My

    Tomcat Web Server SSL Certificate Installation

    How to generate a CSR in Tomcat with Keytool

    Create a New Keystore

    You will need to create a new Keystore, this is done by this command:

    keytool -genkey -alias domainname.prefix -keyalg RSA -keysize 2048 -keystore /path/domainname.prefix.jks

    When the commands ask for the firstname and lastname, please type domainname.prefix instead of you name, else the certificate will issues to you name, instead of the domain name.

    Generate a CSR from Your New Keystore

    1. Next, you need to generate a CSR file, this is done by this command
      keytool -certreq -alias domainname.prefix -file certreq.cer -keystore /path/domainname.prefix.jks
    2. Type the keystore password that you chose earlier and hit Enter.
    3. Please upload the certreq.cer, to you standard certificate supplier.

    Installing the SSL Certificates to the Keystore

    1. You will then get a certificate, save it as signcert.cer
    2. Download aswell the correct intermediate certificate, aswell as the correct root certificate.
    3. Import them with this command:
      keytool -import -trustcacerts -alias root -file root.cer -keystore /path/domainname.prefix.jks
      
      keytool -import -trustcacerts -alias intermediate -file intermediate.cer -keystore /path/domainname.prefix.jks
    1. Import the signed certificate
      keytool -import -trustcacerts -alias domainanme.prefix -file signcert.cer -keystore /path/domainname.prefix.jks

    Configuring your SSL Connector

    Before Tomcat can accept secure connections, you need to configure an SSL Connector.

    1. In a text editor, open the Tomcat server.xml file.
      The server.xml file is usually located in the conf folder of your Tomcat’s home directory.
    1. Locate the connector that you want to use the new keystore to secure.
      Usually, a connector with port 443 or 8443 is used, as shown in step 4.
    1. If necessary, uncomment the connector.
      To uncomment a connector, remove the comment tags (<!– and –>).
    1. Specify the correct keystore filename and password in your connector configuration.

    When you are done, your connector should look something like this:

    <Connector port="443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true"clientAuth="false" sslProtocol="TLS" keyAlias="server" keystoreFile="/path/domainname.prefix.jks " keystorePass="your_keystore_password" />

    Note: If you are using a version of Tomcat prior to Tomcat 7, you need to change “keystorePass” to “keypass”.

    1. Save your changes to the server.xml file.
    2. Restart Tomcat.

     

    Apache and multiple SSL virtual host on same IP address

    In standard way, apache only supports one SSL virtual host per IP address, if you want to use different SSL Certificates file. But with mod-gnutls it is possible to have multiple Virtual host with different SSL Certificates file.

    Install mod-gnutls in Debian:

    apt-get install libapache2-mod-gnutls

    Then you need to enable mod-gnutls

    cd /etc/apache2/mods-enabled
    ln -s ../mods-available/gnutls.* .

    Then you need to create the gnutls cache files

    touch /var/cache/apache2/gnutls_cache
    chmod 700 /var/cache/apache2/gnutls_cache
    chown 33.33 /var/cache/apache2/gnutls_cache

    And then you need to setup the two virtualhost:

    <VirtualHost *:443>
    ServerAdmin [email protected]
    ServerName v1.dalbjerg.nu
    DocumentRoot /var/www/v1.dalbjerg.nu
    GnuTLSEnable on
    GnuTLSPriorities NORMAL
    GnuTLSCertificateFile /etc/apache2/v1/ssl.crt
    GnuTLSKeyFile /etc/apache2/v1/ssl.key
    </VirtualHost>

    <VirtualHost *:443>
    ServerAdmin [email protected]
    ServerName v2.dalbjerg.nu
    DocumentRoot /var/www/v2.dalbjerg.nu
    GnuTLSEnable on
    GnuTLSPriorities NORMAL
    GnuTLSCertificateFile /etc/apache2/v2/ssl.crt
    GnuTLSKeyFile /etc/apache2/v2/ssl.key
    </VirtualHost>

    Then you need to restart apache

    apache2cl restart

    If it don’t work see at /var/log/apache2/error.log to see any error is reporting there.

    [ad]

    Importere StartSSL certifikat ind i Internet Explorer

    Gå ind på adressen https://startssl.com/certs/ca.cer og vælg ”Forsæt til dette websted (Anbefales ikke)”. (Bemærk det er den røde kryds). Vælg herefter åben. Herefter kommer dette billede frem.

    Tryk på Installer certifikat…

    Tryk på næste >

    Tryk Næste >

    Tryk på Udfør

    Tryk på Ja

    Tryk på OK.

    Tryk op OK.

    Luk nu din Internet Explorer ned, og start den op igen, nu skulle du gerne slippe for den advarelse med at vores hjemmeside ikke er godkendt.

    Apache and Certificate

    If you want a sign certificat to use with apache, you need to do this:

    openssl genrsa -des3 -out server.key 1024
    openssl req -new -key server.key -out server.csr

    openssl rsa -in server.key -out server.key.insecure
    mv server.key server.key.secure
    mv server.key.insecure server.key

    Mail the server.csr file to certificat trust. Then you get a file back, rename that file to server.crt

    Then you need to change this 2 lines, in apache.conf

    SSLCertificateFile /etc/httpd/ssl.crt/server.crt
    SSLCertificateKeyFile /etc/httpd/ssl.key/server.key

    Self-Signed IIS SSL Certificates using OpenSSL

    Læs mere her omkring: Self-Signed IIS SSL Certificates using OpenSSL
    Self-Signed IIS SSL Certificates using OpenSSL

    Self-Signed IIS SSL Certificates using OpenSSL

    This tutorial assumes that you have a Linux box with OpenSSL installed,and that you want to create a self-signed certificate for IIS5.0

    1. Set up your CA (you only have to do this once)
    ON THE LINUX BOX…
    * Create a private key

    openssl genrsa -des3 -out CA.key 1024

    (You’ll need to supply a passphrase. DON’T FORGET THIS!!)

    * Set this to read-only for root for security

    chmod 400 CA.key

    * Create the CA certificate

    openssl req -new -key CA.key -x509 -days 1095 -out CA.crt

    (Provide appropriate responses to the prompts…for Common Name, you might want to use something like “OurCompany CA”)

    * Set the certificate to read-only for root for security

    chmod 400 CA.crt

    2. Obtain a CSR
    ON THE IIS BOX…
    * Open the Internet Manager
    * Select the site for which you want to create a key
    * Right-click and choose Properties
    * Select the “Directory Security” tab
    * Click the “Server Certificate” button
    * Follow the prompts to create a CSR
    * Save your CSR, then transfer it to the Linux box for further processing. (For the following steps, we’ll refer to your CSR as “new.csr”)

    3. Sign the CSR
    ON THE LINUX BOX…
    * Sign the CSR (all of this on one line)

    openssl x509 -req -days 365 -in new.csr -CA CA.crt
    -CAkey CA.key -CAcreateserial -out new.crt

    * Transfer the new.crt file back to the IIS box

    4. Install self-signed certificate
    ON THE IIS BOX…
    * Open the Internet Manager
    * Select the site to install the key
    * Right-click and choose properties
    * Select the “Directory Security” tab
    * Click the “Server Certificate” button
    * Specify that you want to complete the pending request
    * Select the .crt file that you just transferred

    That’s it!

    Qmail: Vpopmail & SSL

    Mini howto’s about putting ssl on Vpopmail.
    My Qmail is running after this guide:
    http://www.pipeline.com.au/staff/mbowe/isp/webmail-server.htm

    apt-get install stunnel4
    mkdir -p /var/log/qmail/pop3d-ssl/
    chown -R qmaill.nofiles /var/log/qmail/pop3d-ssl/

    mkdir -p /var/qmail/supervise/qmail-pop3d-ssl
    mkdir -p /var/qmail/supervise/qmail-pop3d-ssl/log

    /var/qmail/supervise/qmail-pop3-ssl/run

    #!/bin/sh
    exec /usr/local/bin/softlimit -m 4000000
    /usr/local/bin/tcpserver -H -R -v -l annsofie.dumdidum.dk -c100 0 995
    /usr/sbin/stunnel4 /var/qmail/control/pop3s.conf 2>&1

    /var/qmail/supervise/qmail-pop3d-ssl/log/run

    #!/bin/sh
    # Keep 30 logs of max 10Mb each
    # They will get rotated when they reach 10Mb in size,
    # or at midnight when our crontab script fires (whichever event comes 1st)
    exec /usr/local/bin/setuidgid qmaill /usr/local/bin/multilog t s10000000 n30 /var/log/qmail/pop3d-ssl

    /var/qmail/control/pop3s.conf

    debug = 1
    output = /var/log/qmail/stunnel.log
    cert = /var/qmail/control/servercert.pem
    exec = /var/qmail/bin/qmail-popup
    execargs = /var/qmail/bin/qmail-popup annsofie.dumdidum.dk /home/vpopmail/bin/vchkpw /var/qmail/bin/qmail-pop3d Maildir

    cd /var/qmail/control/
    openssl req -new -x509 -nodes -out servercert.pem -days 3650 -keyout servercert.pem

    ln -s /var/qmail/supervise/qmail-pop3d-ssl/ /service/
    svc -u /service//qmail-pop3d-ssl