NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate is configured with an IPsec VPN that uses certificate-based authentication. The VPN fails to establish. The administrator checks the phase1 debug and sees the message: 'no suitable certificate found'. What is the most likely cause?
⚠ Common exam trap
Candidates often confuse 'no suitable certificate found' with trust or revocation issues, but the error specifically points to a missing or mismatched local certificate, not problems with the peer's certificate or CA chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The local certificate is not imported or does not match the certificate name
The 'no suitable certificate found' error in IPsec phase1 debug indicates that the FortiGate cannot locate a local certificate that matches the peer's expected certificate name (often the peer's ID or the configured local certificate name). This typically occurs when the local certificate is not imported or the certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the configured local ID or peer's expected identifier. Without a matching local certificate, the IKE exchange cannot proceed to authenticate the FortiGate to the remote peer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The peer's certificate is not trusted
Why it's wrong here
An untrusted peer certificate surfaces during validation as a trust or CA-chain error, not as local certificate selection failing. 'No suitable certificate found' means the local store lacks a certificate matching the peer's requested criteria. Trust issues arise when the remote gateway's certificate chains to an unknown CA.
- ✗
The certificate revocation list (CRL) is outdated
Why it's wrong here
An outdated CRL causes validation failure after a certificate is selected, producing revocation errors rather than selection failure. 'No suitable certificate found' occurs before validation, when no local certificate matches the requested CA or key type. CRL checking matters when a revoked peer certificate must be rejected.
- ✗
The CA certificate is missing
Why it's wrong here
A missing CA certificate breaks trust-chain validation of the peer's certificate, yielding a trust error, not a local selection failure. The message means no local identity certificate matches the peer's requested criteria. A CA certificate is needed to verify the remote gateway's identity during phase 1.
- ✓
The local certificate is not imported or does not match the certificate name
Why this is correct
Certificate-based IPsec requires a local certificate whose subject or name matches the phase1 configuration. If it is absent from the FortiGate keystore, or its name differs from the one referenced in phase1, IKE cannot present a valid identity, producing the 'no suitable certificate found' error.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.