Error while trying to renew my cert on FortiGate

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: union-data.offthegriid.com

I ran this command: diagnose sys acme status-full

It produced this output:

Union-Data-01 (global) # diagnose sys acme status-full union-data.offthegriid.com
{
  "name": "union-data.offthegriid.com",
  "finished": false,
  "notified": false,
  "next-run": "Tue, 12 Dec 2023 15:57:49 GMT",
  "last-run": "Tue, 12 Dec 2023 14:57:48 GMT",
  "errors": 398,
  "last": {
    "status": 22,
    "status-description": "Invalid argument",
    "problem": "urn:ietf:params:acme:error:malformed",
    "detail": "No order for ID 226165665486"
  },
  "log": {
    "entries": [
      {
        "when": "Tue, 12 Dec 2023 14:57:49 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:49 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:49 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:49 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:48 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:48 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:48 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:48 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:48 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 14:57:48 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:47 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:47 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:47 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 13:57:46 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:46 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:46 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:46 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 12:57:45 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:45 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:45 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:45 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 11:57:44 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:04 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:04 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:04 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:04 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:03 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:03 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:03 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:03 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:03 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 11:15:03 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:43 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:43 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:43 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:53:42 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:02 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:02 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:02 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:43:01 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:41 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:41 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:41 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:37:40 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:35:00 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:35:00 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:35:00 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:59 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:59 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:59 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:58 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:58 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:58 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:34:58 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:38 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:38 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:38 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:38 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:38 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:38 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:37 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:37 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:37 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:33:37 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:57 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:57 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:57 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:57 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:56 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:56 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:56 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:56 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:56 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:56 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:36 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:36 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:36 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:36 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:35 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:35 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:35 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:35 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:35 GMT",
        "type": "progress",
        "detail": "Checking staging area"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:35 GMT",
        "type": "starting"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:25 GMT",
        "type": "message-errored"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:25 GMT",
        "type": "renewal-error",
        "status": "urn:ietf:params:acme:error:malformed",
        "detail": "No order for ID 226165665486"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:25 GMT",
        "type": "progress",
        "detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:25 GMT",
        "type": "progress",
        "detail": "Loaded order from staging"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:24 GMT",
        "type": "progress",
        "detail": "Selecting account to use for union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:24 GMT",
        "type": "progress",
        "detail": "Driving ACME protocol for renewal of union-data.offthegriid.com"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:24 GMT",
        "type": "progress",
        "detail": "Contacting ACME server for union-data.offthegriid.com at https://acme-v02.api.letsencrypt.org/directory"
      },
      {
        "when": "Tue, 12 Dec 2023 10:32:24 GMT",
        "type": "progress",
        "detail": "Assessing current status"
      }
    ]
  }
}

My web server is (include version): FortiGate 601e

The operating system my web server runs on is (include version): v7.0.13

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

Hi @Jideojabs, and welcome to the LE community forum :slight_smile:

hmm...
Can you go to 7.2 or 7.4 ?

Do you have multiple ISPs?

2 Likes

Did you create the certificate on the Fortinet or import it? 7.2 and 7.4 won't help. I use 7.2.6 on my Fortinet 60E and they took away options.

All my gates create their own certs.
All the webservers create their own certs.

3 Likes

Is the Fortigate cert configured for automatic renewal or did you do it manual install.

They renew automatically.

2 Likes

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/822087/acme-certificate-support

Step #8 requires you to set the ACME interface(s).
image

Have you done that?

2 Likes

Acme Interfaces are WAN1 and WAN2 because I have two ISPs and SD-WAN.

1 Like

I've seen issues previously when multiple interfaces where added.
Again, I don't recall the specific ForitOS version - but TAC should be able to confirm that you are beyond that version number.

And SD-WAN can also create issues with ACME.
Issues they have overcome in recent releases.
Again, speak with Fortinet support to ensure you are not affected.

4 Likes

Yes we do, and we have other sites running on the same OS with no issue.

Yes it is set on my outgoing interface.

You have two to choose from...
It should be set to the interface with the IP that is resolved from the FQDN that's trying to get a cert.

2 Likes

Yes it is set to that, I resolved the issue by deleting it and creating a new one. Looks like LE didnt have an entry for my domain.

Please explain that in more detail.

What do you mean by that?

2 Likes

"detail": "No order for ID 226165665486, problem: urn:ietf:params:acme:error:malformed"

This potentially looks like an instance of "the 404 bug", where boulder sometimes returns a 404 if it queries a replica that is a bit behind. This is a long-standing issue with Let's Encrypt and can cause spurious errors. Retrying usually fixes it, as it happens randomly depending on what database replica gets used.

4 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.