Technical Tip: FortiGate GUI Access stopped working after upgrade to v7.2.11/v7.4.8/v7.6.1

Description

This article describes how to restore GUI access after upgrading to v7.2.11/v7.4.8/v7.6.1.

Scope

FortiGate GUI Access.

Solution

After replacing the firewall's GUI certificate with a new certificate signed by an external server (PFX+password) the GUI became inaccessible.

Starting from v7.2.11/v7.4.8/v7.6.1, FortiGate supports OpenSSL v3.4.0 and it requires a minimum RSA key of 2048 bits.

Any certificates using an RSA key of less than 2048 bits are no longer supported, if such a certificate is used, GUI access will stop working.

This change came after OpenSSL v3.2.0 changed the default security level to 2, which means that it required a minimum RSA of 2048 bits.

The user can check the RSA keys of the certificate by running the command or in Windows under certificate details.

openssl x509 -in name_of_certificate.cer -text -noout

Further information is available in the following GitHub readme: OpenSSL changes.

To address the issue, either use the default certificate as shown below, or use a new certificate that meets the minimum requirements:

config system global
    set admin-server-cert "Fortinet_GUI_Server"
end