Our VPN Cert is build through the integrated Let's Encrypt feature in FortiGate and should be valid for 90 days and renew with 30 days leeway (as far as I understand it). It has the ISRG Root and is issued by R3, however since I upgraded to 7.2 this is the first time the renewal has come about and i…

After upgrading, if the ACME setting have more than one WAN interface assigned it will not reach out to the letsencrypt servers at all, not even to remind you that your cert is near expiration. As fault tolerance, I have two ISP's assigned, Causing this issue. Solution: Only ever assign 1 WAN port …

I think this question might be better directed at FortiGate support since the issue seems to be with their implementation or the upgrade.

[image] Wconnor: it did not Auto Renew What is the error message shown on the cert? system | certificates <certificate> comments

It didn't error, as far as it looks it didn't even try. its comment output is: "Renewed with ACME on Mon Oct 3 14:20:55 2022 (UTC)"

That seems like a definite upgrade "bug". It should have tried to renew after 60 days... [some quik mafs...] On Dec 2nd - ten days ago! I would open a ticket with Fortinet. And do keep us informed on the outcome - thanks

I have, and I will post end results. Thanks fellas!

So, it was already failing to renew before the upgrade (due to the multiple WANs)? OR Did this problem surface in this new version? And thx for getting back on this :wink:

It worked on a previous version in October, I would have been on 7.0. Which version upgrade made this non-viable I couldn't say definitively. The jump to 7.2, or a smaller update is unclear. What I can confirm to the community is that on 7.2.3 it will not work with the ACME setting allowing multipl…

Since you mentioned the October timeframe; but this took effect on September 15, 2022. [image] Rejecting SHA-1 CSRs and validation using TLS 1.0 / 1.1 URLs API Announcements O…

I looked into that right away. I was already using the v02.api address ruling out this as my issue "when": "Sun, 02 Oct 2022 15:20:01 GMT", "type": "progress", "detail": "Contacting ACME server for vpn.redacted.com at https://acme-v02.api.letsencrypt.org/directory "

Can you attach the actual CSR to a post?

Fortigate 7.2.3 Cert renewal

Help

Bruce5051 December 20, 2022, 9:52pm 11

Since you mentioned the October timeframe; but this took effect on September 15, 2022.

Topic		Replies	Views
Error while trying to renew my cert on FortiGate Help	15	1941	December 12, 2023
Let's Encrypt certificate problem with Fortigate firewall Help	7	10203	October 4, 2021
How to recreate a certificate on Fortigate FOS 7.0.1 Help	12	5587	October 27, 2021
ACME client on the new FortiOS 7.0 Help	4	9951	April 16, 2021
FortiOS 7.2 - Error (No order for ID X) Help	11	2650	September 21, 2023

Fortigate 7.2.3 Cert renewal

Related topics