An administrator needs to connect FortiClient EMS as a fabric connector to FortiGate What is the prerequisite to get FortiClient EMS lo connect to…

When configuring the FortiClient EMS Fabric Connector on FortiGate, a secure TLS connection is established. FortiGate must validate the identity of the FortiClient EMS server. This is achieved by FortiGate trusting the Certificate Authority (CA) that issued the EMS server's certificate. Therefore, the administrator must export the CA certificate from EMS (often the EMS built-in CA) and import it into FortiGate as a trusted CA certificate to ensure the connection is successfully verified and established.

B. Revoke and update the FortiClient client certificate on EMS. This action relates to individual endpoint clients, not the connection between the FortiGate and the EMS server itself.

C. Import and verify the FortiClient client certificate on FortiGate. FortiGate needs to trust the EMS server, not an individual FortiClient endpoint, for this specific fabric connector configuration.

D. Revoke and update the FortiClient EMS root CA. Revoking the root CA would invalidate the trust chain, preventing a successful connection rather than enabling it.

FortiClient EMS 7.2.2 Administration Guide, "FortiGate Telemetry," page 185. The guide states, "On the FortiGate, you must import the EMS server's certificate authority (CA) certificate so that the FortiGate can verify the EMS server's identity."

Fortinet Cookbook, "Connect FortiClient EMS to the Security Fabric," Document Version 1.0. The procedure explicitly details exporting the EMS CA certificate and importing it on the FortiGate under System > Certificates.