Problem description:
In cases where a certificate is not renewed before its expiration date, all certificate-based IPsec VPN tunnels using that certificate may become unavailable, resulting in service disruption. The impact can be particularly severe when multiple tunnels depend on the same certificate and all remote management traffic traverses those tunnels, potentially isolating the affected site and preventing remote recovery. This proposed solution leverages FortiOS support for multiple certificates within a single Phase 1 configuration, providing an additional layer of redundancy and reducing the risk of outages caused by certificate expiration.
Traditional certificate-based VPN deployments often rely on a single local certificate:
config vpn ipsec phase1-interface
edit "VPN_1"
set authmethod signature
set certificate "CERT_1"
next
end
When the certificate expires:
IKE authentication fails. Phase 1 negotiation cannot complete. All dependent tunnels become unavailable. Business-critical connectivity may be disrupted.
The root cause is typically not the certificate itself, but a failure in the renewal process (SCEP, ACME, manual replacement, CA availability, etc.).
FortiOS supports configuring multiple certificates under a single IPsec Phase1-interface.
Example:
config vpn ipsec phase1-interface
edit "VPN_1"
set interface "port1"
set ike-version 2
set keylife 3600
set authmethod signature
set net-device disable
set proposal aes256-sha256
set remote-gw 10.50.13.167
set certificate "CERT_1" "CERT_2"
set peer "ROOT"
next
Using certificates with different expiration dates in the configuration above helps to:
Keep the tunnel operational. Avoid Phase1 reconfiguration. Avoid manual certificate replacement. Improves survivability against certificate renewal failures.
Both certificates should be issued by the same Certificate Authority (CA) hierarchy and chain to the same trusted Root CA.
To further enhance resiliency, consider using different certificates for different VPN tunnels instead of relying on a single certificate across the entire deployment. For example, spoke devices may use CERT1 for tunnels terminating on Hub1 and CERT2 for tunnels terminating on Hub2. Alternatively, tunnels traversing the Internet can use CERT1, while tunnels over a private WAN/MPLS network use CERT2. This design reduces dependency on a single certificate and helps prevent a certificate expiration or renewal failure from causing a simultaneous outage of all VPN connectivity.
Summary:
As a best practice, avoid placing all IPsec VPN tunnels behind a single certificate, as a certificate expiration or renewal failure can cause a widespread outage. FortiOS supports configuring multiple certificates within a single Phase 1 interface, providing certificate-level redundancy if one certificate becomes unavailable. For even greater resiliency, distribute tunnels across different certificates (for example, by hub or transport type), reducing the risk that a single certificate issue will impact all VPN connectivity simultaneously.
Related documents:
Technical Tip: FortiGate Certificate enrollment and renewal using SCEP Technical Tip: Certificate renewal via EST server Technical Tip: Configure local certificate expiry Automation Stitch with an email notification | 
