ZTNA Tag Loss After EMS Certificate Rotation
An 800-user professional services firm uses FortiClient EMS on-premises integrated with FortiSASE and ZTNA for six internal applications. Endpoint posture requires disk encryption and antivirus. After an EMS certificate rotation, 120 macOS users show 'unable to connect to EMS' and lose the 'managed' ZTNA tag, while Windows users remain connected. Contractors use unmanaged Windows laptops and need browser-only access to one application. FortiSASE logs show 'certificate verify failed' for macOS and 'ZTNA tag not found' for the affected users. The firm wants to avoid reinstalling FortiClient on every Mac and must restore access within four hours. The ZTNA rule currently requires the managed tag and device certificate.
1. How do you restore macOS EMS connectivity after the certificate rotation without reinstalling FortiClient?
Read the worked answer
The macOS clients do not trust the new EMS certificate chain. Check whether the EMS certificate is signed by a CA trusted by macOS, whether the full chain is presented, and whether the FortiClient profile pins the old certificate. Push the new root and intermediate certificates to the Macs through MDM or a configuration profile, then restart the FortiClient service and verify registration. Confirm system time and TLS trust with a browser or curl to the EMS endpoint. Do not reinstall until trust is fixed; reinstallation will fail the same way. Check EMS logs for the certificate verify failed message and confirm the FortiSASE connector is healthy.
2. Why is the ZTNA tag missing, and how do you restore access within four hours?
Read the worked answer
The managed tag is generated from EMS endpoint telemetry. When macOS clients cannot connect to EMS, FortiSASE stops receiving posture and device data, so the tag disappears and the ZTNA rule denies access. Fix EMS trust first, force an endpoint sync, and confirm the tag reappears in FortiSASE. For the four-hour window, create a temporary ZTNA rule for the affected macOS user group that requires SSO and MFA and limits access to the six applications or only the critical application. Do not remove posture requirements globally. Log the exception, set an expiry, and remove it after tags are restored.
3. How should contractors get browser-only access to one application?
Read the worked answer
Contractors should not receive the managed tag. Use a separate ZTNA policy for unmanaged devices with browser-based access, SAML authentication, MFA, and a narrow application entitlement to the one application. Restrict methods and permissions, enable session logging, and set a short session timeout. Do not install FortiClient on contractor devices or issue device certificates unless required. Validate that the policy does not match the managed-device rule and that contractors cannot reach the other five applications. If browser-based ZTNA is not licensed, provide a managed virtual desktop instead of weakening the ZTNA rule.