Technical Tip: Renew the ACME certificate outside of working hours

In most cases, the renewal of the Let's Encrypt certificate for SSL VPN happens during working hours.

This causes interruptions in the traffic. 

In this scenario, it would be better to have the renewal of this certificate outside of working hours. 

In general, Let's Encrypt issues certificates that last 90 days, and by default, FortiGate is trying to renew the certificate 30 days before the expiration.

The relevant configuration extract is below:

config vpn certificate local
    edit <ACME_certificate_name>
        set acme-renew-window 30
end

However, the certificate renewal cannot be explicitly scheduled. 

To be able to manipulate the renewal timing, the user can manually renew the certificate outside of working hours, and this should trigger the next renewal exactly X days before the expiration (based on the acme-renew-window setting). 

Should the previous certificate renewal be outside working hours, the upcoming certificate renewal will be triggered right at the time the X-day window has been reached, and this should also be around the time the previous certificate renewal happened.