Technical Tip: System certificate used by DNS proxy is not referenced

Description

This article provides an explanation of the apparent inconsistency between GUI and CLI references.

Scope

FortiGate.

Solution

In Network -> DNS -> SSL certificate, when 'Use FortiGuard Servers' certificate is being selected, as described as 'Used by a DNS proxy as a DNS server so that the DNS proxy can provide service over TLS, as well as normal UDP/TCP'. That certificate is not being referenced as per the GUI, while it is being referenced in the CLI.

As per the GUI:

As a next step, the certificate is being changed. On the GUI, the change looks as follows:

The change is being tracked with the CLI debug:

hudzen-esx33 # 0: config system dns
0: set primary 96.45.45.45
0: set protocol dot
0: set ssl-certificate "Fortinet_Factory_Backup"
0: set server-hostname "globalsdns.fortinet.net"
0: end

As per the GUI reference in System -> Certificates, this certificate is not being referenced:

However, as per the CLI, this certificate is referenced:

hudzen-esx33 # show | grep -f "Fortinet_Factory_Backup"
config system dns
set primary 96.45.45.45
set secondary 96.45.46.46
set protocol dot
set ssl-certificate "Fortinet_Factory_Backup" <---
set server-hostname "globalsdns.fortinet.net"
end

For this purpose, an internal investigation was launched. As per the explanation of the engineering team, this behavior is not a bug, but is as per design: the datasource path is certificate.local (GLOBAL) as system.dns is GLOBAL; vpn.certificate.local is per VDOM. When the VDOM mode is not enabled, the user cannot operate the GLOBAL certificate.local, therefore. vpn.certificate.local is mirrored to certificate.local and therefore not referenced.