Fedora 44 Cosmic VPN secrets

Ask Fedora
,
1

The Network Applet fails to connect to VPN with OpenConnect (Forti SSL VPN)
Error message states “Connection activation failed: No valid secrets”.

Screenshot2026-06-2408-19-52
Screenshot2026-06-2408-19-52552×386 28.2 KB

There were several open issues in Cosmic for this, which should have gotten fixed by refactor: use secret agent for managing passwords by wash2 · Pull Request #1673 · pop-os/cosmic-settings · GitHub.

Unfortunately the issue still persists.

Systemd reports

fedora NetworkManager[2363]: <info>  [1782281422.9439] agent-manager: agent[25f0602c18034fe4,:1.180/com.system76.CosmicSettings.VPN.NetworkManager.SecretAgent/1000]: agent registered
fedora NetworkManager[2363]: <info>  [1782281425.0991] agent-manager: agent[bea481cb8462488d,:1.181/nmcli-connect/1000]: agent registered
fedora NetworkManager[2363]: <info>  [1782281425.1227] vpn[0x5585e842bd00,9712b4f9-2115-4c9e-9450-5945137902c7,"Admin VPN"]: starting openconnect
fedora NetworkManager[2363]: <info>  [1782281425.1231] audit: op="connection-activate" uuid="9712b4f9-2115-4c9e-9450-5945137902c7" name="Admin VPN" pid=15270 uid=1000 result="success"
fedora dbus-broker[2138]: A security policy denied :1.179 to send method call /org/freedesktop/NetworkManager/Settings:org.freedesktop.NetworkManager.Settings.LoadConnections to org.freedesktop.NetworkManager.
fedora dbus-broker[2138]: A security policy denied :1.178 to send method call /org/freedesktop/NetworkManager/Settings:org.freedesktop.NetworkManager.Settings.LoadConnections to org.freedesktop.NetworkManager.
fedora dbus-broker[2138]: A security policy denied :1.113 to send method call /org/freedesktop/NetworkManager/Settings:org.freedesktop.NetworkManager.Settings.LoadConnections to org.freedesktop.NetworkManager.
fedora dbus-broker[2138]: A security policy denied :1.179 to send method call /org/freedesktop/NetworkManager/Settings:org.freedesktop.NetworkManager.Settings.LoadConnections to org.freedesktop.NetworkManager.

I wasn’t able to trace the issue further. I tried fiddeling around with recording the DBUS traffic, but due to lack of knowledge wasn’t able to read anything from it.

Starting the VPN via cli (nmcli --ask connection up "Admin VPN") works just fine, so I’m kind of ruling out the VPN config

Any help would be greatly appreciated, as this is a major headache when daily driving Fedora Cosmic in an enterprise environment.

My System:
Fedora 44
Cosmic 1.0.16, 1.fc44
Kernel 7.0.12-201.fc44.x86_64
Secrets store/keyring: gnome-keyring (Enabled as per GNOME Keyring on COSMIC, and works fine to store other secrets)

2

If there are any further information I can provide, or if this is the wrong place for this question, please let me know.

3

NetworkManager allows storing secrets in the connection profile.
This should eliminate the need for asking it interactively.
See also: nm-connection-editor - Fedora Packages

4

Thanks for your help.
I did use NetworkManager to set the connection up and enter the secrets.
Doesn’t change anything :frowning:

5

Try a different connection editor such as the one linked above.
Be sure to store the secrets for all users.
Verify it by inspecting the saved connection profile:

/etc/NetworkManager/system-connections/...
6

The connection got set up (see profile below).
The password for the actual VPN connection gets saved in there (which isn’t great, but works)

The problem is the password necessary to unlock the private key used to authenticate against the Forti SSL VPN Gateway. This one doesn’t get saved in the profile.

This propably is a Forti SSL VPN problem, but one that exists anyway.

# /etc/NetworkManager/system-connections/Admin\ VPN.nmconnection
[connection]
id=Admin VPN
uuid=9712b4f9-2115-4c9e-9450-5945137902c7
type=vpn
autoconnect=false
permissions=user:benni:;
timestamp=1782494465

[vpn]
authtype=cert
autoconnect-flags=0
cacert=REDACTED
certsigs-flags=0
cookie-flags=2
disable_udp=no
enable_csd_trojan=no
gateway=REDACTED
gateway-flags=2
gwcert-flags=2
lasthost-flags=0
pem_passphrase_fsid=no
prevent_invalid_cert=no
protocol=fortinet
resolve-flags=2
stoken_source=disabled
usercert=REDACTED
userkey=REDACTED
xmlconfig-flags=0
service-type=org.freedesktop.NetworkManager.openconnect

[vpn-secrets]
password=REDACTED

[ipv4]
dns=REDACTED;
method=auto

[ipv6]
addr-gen-mode=stable-privacy
method=auto

[proxy]
7

This is how it works for OpenVPN:

[vpn]
cert-pass-flags=0
...

[vpn-secrets]
cert-pass=PASSWORD
...

I hope this works for Fortinet SSLVPN as well.
Remember to apply the changes:

sudo systemctl restart NetworkManager.service

Another option is decrypting the private key: