Troubleshooting Tip: ACME certificate auto renewal fails with an error 'Unable to retrieve certificate chain'

Description

This article describes a known issue with renewing ACME certificates on FortiOS, and provides a workaround.

Scope

FortiOS versions starting from v7.4.9, FortiOS v7.6 GA.

Solution

The following errors may be encountered while renewing an ACME certificate on FortiGate:

• GUI: 'Unable to create certificate'.

• CLI: 'Unable to retrieve certificate chain'.

• CLI: 'Too many failed authorizations'.

The issue is triggered due to a conflicting ike-tcp-port configured as a 443 port, and a udp-fallback-tcp setting applied on the phase1-interface.

There are multiple workarounds available to renew the certificate with:

1. Preferred: Set 'ike-tcp-port' to a port other than 443, or use 'set transport udp' in 'phase1-interface'. It will allow the ACME client to serve tls-alpn-01 challenges on port 443. See Technical Tip: How to use TCP as transport for IKE/IPsec traffic.

2. If the preferred option is not possible: Enable 'speedtest-server' on port 443:

config system global
    set speedtest-server enable
    set speedtestd_ctrl_port 443
end

3. Make sure no interface is configured with 'set allowaccess speed-test'.

4. Execute these commands to restart the ACME service:

diagnose sys acme regenerate-client-config
diagnose sys acme restart

• It is also recommended to verify that no upstream device or service is blocking or inspecting TLS‑ALPN‑01 traffic on port 443, as this can still prevent successful certificate renewal even when the listed workarounds are applied.

Related document:

Automatically provision a certificate