Technical Tip: ACME TLS-ALPN-01 validation fails due to incorrect DNS resolution of the FortiADC Virtual Server

Description

This article describes a scenario where ACME TLS-ALPN-01 certificate enrollment fails on FortiADC because the domain name used during validation resolves to an IP address different from the FortiADC Virtual Server configured to handle the challenge.

Scope

FortiADC.

Solution

When attempting to generate an ACME certificate using the TLS-ALPN-01 challenge method, the enrollment process may fail with errors similar to the following:

TLSAlpn01ChallengeValidator::TryGetChallengeCert:
IPv4 address TLS connection failed to return certificate.

TLSAlpn01ChallengeValidator::GetChallengeCertificate:
Connection to x.x.x.x:443 timed out.

The above errors may be a result of the Fully Qualified Domain Name (FQDN) configured for ACME validation resolving to an IP address different from the IP address configured on the FortiADC HTTPS Virtual Server responsible for handling the TLS-ALPN-01 challenge.

As a result, the ACME provider attempting to establish a TLS connection to the wrong destination is unable to retrieve the challenge certificate.

Verify the following items when troubleshooting ACME TLS-ALPN-01 validation failures:

1. Confirm that the FQDN used during ACME enrollment resolves to the FortiADC Virtual Server IP address configured for the challenge process.

2. Confirm that TCP port 443 is reachable from the ACME provider.

3. Confirm that the HTTPS Virtual Server is associated with the correct Client SSL Profile.

4. Confirm that the Client SSL Profile references the intended Local Certificate Group.

5. Confirm that the certificate was created using the ACME enrollment workflow rather than imported as a standard local certificate.

After correcting the DNS resolution so that the FQDN resolved to the Virtual Server IP address configured for ACME validation, the TLS-ALPN-01 challenge completed successfully, and the certificate was issued and installed on FortiADC.

Additional information:

For ACME TLS-ALPN-01 validation and certificate renewal, the ACME provider must be able to establish a TLS connection to TCP port 443 on the endpoint associated with the enrolled FQDN.

When using an ACME certificate for the FortiADC administrative interface, a reachable HTTPS Virtual Server on port 443 may still be required for the TLS-ALPN-01 challenge even when the administrative GUI is configured to listen on a different port.

Related document:
Generating an ACME Certificate (Automated Enrollment)