Troubleshooting Tip: Common causes for Let's Encrypt (ACME) certificate renewal failure

Description

This article identifies the common configuration and network issues that prevent Let's Encrypt (ACME) certificates from renewing automatically on a FortiGate.

Scope

FortiOS v7.0, v7.2, v7.4, and v7.6.

Solution

FortiGate uses an integrated ACME client to automatically provision and renew Let's Encrypt certificates. Certificates are valid for 90 days, and FortiGate automatically attempts renewal 30 days before expiration. To function correctly, the ACME interface (usually WAN) must be set to handle the HTTP-01 challenge from Let’s Encrypt.

ACME certificate support is a new feature introduced in FortiGate v7.0: ACME certificate support.

There are 3 requirements for the Let's Encrypt certificate auto-renewal:

• ACME certificate support v7.0.

• ACME certificate support v7.2.

• Automatically provision a certificate v7.4.

1. Port conflicts and administrative settings.

The ACME protocol typically requires port 80 (HTTP) or 443 (HTTPS) to be open for the validation challenge.
 

• Service Overlaps: If SSL VPN or other HTTP services are listening on the same ports as the ACME interface, the validation will fail. Ensure 'https-redirect' is disabled in the SSL VPN settings to allow the ACME client to share port 443. Alternatively, change the SSL VPN port to a different port.

config vpn ssl settings
    set https-redirect disable
    set port 10443

• Default HTTPS Port Requirements: Disable the 'admin-https-redirect' setting under global settings when the admin HTTP port is set to 80 or change the HTTP admin port:

config system global
    set admin-https-redirect disable 
    set admin-sport 4443
end

When the FortiGate's public-facing interface is configured to use a custom HTTPS management port (for example, 4443), ensure that it is using the default port 443.

• Default IKE-tcp-port: Starting from FortiOS v7.6.1 and onward, the default IKE TCP port has changed to 443, which may also cause the ACME to fail.

config system settings
    set ike-tcp-port 443
end

Virtual IP (VIP) Interference: If an active Virtual IP is used for a Static NAT or Port Forwarding on port 443 that uses the IP address as the ACME listening interface, this will prevent the certificate from being renewed. Change the External Virtual IP or the External Service port in the Port Forwarding so it does not conflict with the ACME port 443.

2. Access control and trusthost restrictions.

• Firewall and Local-in Policies: Strict security policies can block the incoming validation request. Ensure that inbound traffic is allowed on ports 80 and 443. Local-in policy can prevent HTTPS and HTTP traffic. This can be validated using the following command:

show firewall local-in policy

More information about that can be found here: Local-in policy.

Note: Geo-IP Blocking: Let's Encrypt uses a global network of validation servers. If the Geo-IP filter blocks regions outside the local area or country, the renewal may fail. Most common setups involve configuring local-In policies using the Geo-IP database.

• Trusthost Restrictions: If the admin user associated with the ACME process has trusthost restrictions, the validation request might be rejected. These should be reviewed or temporarily disabled during the renewal window. A simple solution is to create a temporary admin without a trusted host configuration. 

3. Network connectivity and interface configuration.

• Incorrect ACME Interface: The ACME interface must be the one facing the public internet and must match the DNS A-record for the domain. Use the 'show system acme' to verify the assigned interface. Furthermore, the WAN interface where the certificate is provisioned must be active at the time of provisioning. Run the command 'get router info routing-table all' and look for the active default route with an asterisk sign(*), and verify if it's by the WAN interface in question.
  

• DNS Name resolutions: Also, verify if the domain matches the IP address configured on the FortiGate WAN interface. On the Windows machine, open the command prompt and then type 'nslookup example.com' and then make sure it is resolving to the same IP address as the WAN interface on the FortiGate. 
  

• DNS and API Reachability: The FortiGate must be able to resolve and reach acme-v02.api.letsencrypt.org. Test this with:

execute ping acme-v02.api.letsencrypt.org

Troubleshooting commands:

If all of the requirements described above have been satisfied but the certificate auto-renewal is still not taking place, run the following commands on FortiGate. If FortiGate is set up in HA, run the following commands on all HA cluster members:

1. Check ACME status:

get system acme status
get system acme acc-details

2. To force config regeneration and certificate renewal:

diagnose sys acme regenerate-client-config
diagnose sys acme restart

In FortiOSv7.4, the command is:

diagnose sys acme purge-archive

3. Wait 2-3 minutes, and check the certificate status:

get vpn certificate local details <Local certificate name>
diagnose sys acme status-full <Certificate’s CN domain> 

To change the ACME listening interface/source-ip:

config system acme
    set interface <interface-name>
    set source-ip <ipv4-address>
end

 
Note: Check that SSL VPN Settings do not have Listen on Port set to 443.

If a specific WAN interface is selected in the ACME settings, ensure that the same WAN interface route is active in the routing table.

Increase window size (acme-renew-window) for ACME renewal. By default, the acme-renew-window settings are set to 30:

config vpn certificate local
    edit <ACME_certificate_name>
        set acme-renew-window 30
end 

This means that the ACME certificate will renew 30 days before expiration, not after 30 days.
Let's Encrypt issues certificates that last 90 days. For example, to renew after 30 days, to change the renew window value to 60:

Use the following commands to increase the window size for ACME renewal:

config vpn certificate local
    edit <ACME_certificate_name>
        set acme-renew-window 1
end

Note 2: If VDOM is configured on a FortiGate, the 'config system acme' settings must be applied in the global VDOM, and ACME certificate information can be viewed using 'config certificate local' under global VDOM.

If the issue persists, remove the reference configuration of the ACME certificate (if the certificate is currently used in SSL VPN or admin-server certificate settings). It is possible to temporarily change the ACME certificate in SSL VPN or admin-server certificate to the built-in Fortinet certificate of FortiGate, then force configuration regeneration and certificate renewal:

diagnose sys acme regenerate-client-config
diagnose sys acme restart

Example output when the ACME certificate is renewed:

get vpn certificate local details acme-cert
== [ acme-cert ]
Name: acme-cert
Subject: CN = test.ftntlab.de
Issuer: C = US, O = Let's Encrypt, CN = R3
Valid from: 2023-02-13 05:00:45 GMT
Valid to: 2023-05-14 05:00:44 GMT
Fingerprint: 9A:03:0F:41:29:D7:01:45:04:F3:16:C0:BD:63:A2:DB
Serial Num: 03:d3:55:80:d2:e9:01:b4:ca:80:3f:2e:fc:24:65:ad:7c:0c
ACME details:
Status: The certificate for the managed domain has been renewed successfully and can be used from Mon, 13 Feb 2023 20:51:14 GMT on.
Staging status: Nothing in staging

diagnose sys acme status-full test.ftntlab.de
{
"name": "test.ftntlab.de",
"finished": true,
"notified": false,
"next-run": "Mon, 13 Feb 2023 20:51:14 GMT",
"last-run": "Mon, 13 Feb 2023 06:00:37 GMT",
"valid-from": "Mon, 13 Feb 2023 20:51:14 GMT",
"errors": 0,
"last": {
"status": 0,
"detail": "The certificate for the managed domain has been renewed successfully and can be used from Mon, 13 Feb 2023 20:51:14 GMT on.",
"valid-from": "Mon, 13 Feb 2023 20:51:14 GMT"
},
"log": {
"entries": [
{
"when": "Mon, 13 Feb 2023 06:00:46 GMT",
"type": "finished"
},
{
"when": "Mon, 13 Feb 2023 06:00:46 GMT",
"type": "progress",
"detail": "The certificate for the managed domain has been renewed successfully and can be used from Mon, 13 Feb 2023 20:51:14 GMT on."
},
{
"when": "Mon, 13 Feb 2023 06:00:46 GMT",
"type": "progress",
"detail": "Retrieving certificate chain for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:45 GMT",
"type": "progress",
"detail": "Waiting for finalized order to become valid"
},
{
"when": "Mon, 13 Feb 2023 06:00:45 GMT",
"type": "progress",
"detail": "Submitting CSR to CA for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:45 GMT",
"type": "progress",
"detail": "Creating CSR for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:45 GMT",
"type": "progress",
"detail": "Finalizing order for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:44 GMT",
"type": "progress",
"detail": "Waiting for order to become ready"
},
{
"when": "Mon, 13 Feb 2023 06:00:44 GMT",
"type": "progress",
"detail": "Monitoring challenge status for test.ftntlab.de: domain authorization for test.ftntlab.de is valid"
},
{
"when": "Mon, 13 Feb 2023 06:00:41 GMT",
"type": "progress",
"detail": "Monitoring challenge status for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:41 GMT",
"type": "progress",
"detail": "Setting up challenge 'http-01' for domain test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:40 GMT",
"type": "progress",
"detail": "Starting challenges for domains"
},
{
"when": "Mon, 13 Feb 2023 06:00:39 GMT",
"type": "progress",
"detail": "Creating new order"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Creating new ACME account for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Selecting account to use for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Driving ACME protocol for renewal of test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Resetting staging for test.ftntlab.de"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Contacting ACME server for test.ftntlab.de at https://acme-v02.api.letsencrypt.org/directory"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Assessing current status"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Resetting staging area"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "progress",
"detail": "Checking staging area"
},
{
"when": "Mon, 13 Feb 2023 06:00:37 GMT",
"type": "starting"
}
]
}
}

In FortiOS v7.2.6, run the following configuration in the CLI to renew the certificate:

config vpn certificate local
    edit <acme_cert>
        set acme-rsa-key-size 4096
    next
end

After, restart the ACME process with the following command:

diagnose system acme restart

After renewal, a message may sometimes appear stating that the certificate is created with the status 'Unknown'.

The certificate for the managed domain has been renewed successfully and can be used (valid since Tue, 16 Dec 2025 16:36:35 GMT). A graceful restart now is recommended.

To resolve this issue, delete the ACME account and then recreate/renew the certificate.

For example:

config system acme
    config accounts
        delete "ACME-.letsencrypt.org-0000"
end

 
Note:

If the FortiGate is not reachable on ports 80 or 443, it will be possible to see the timeout renewal failures.

If FortiGate is configured to use a custom HTTPS port, the renewal will fail with the following error:

{
"name":"vpn.abcd.com",
"finished":true,
"notified":true,
"notified-renewed":false,
"next-run":"Fri, 08 Nov 2025 23:41:20 GMT",
"last-run":"Fri, 08 Nov 2025 16:31:53 GMT",
"errors":14,
"last":{
"status":22,
"status-description":"Invalid argument",
"detail":"domain authorization for vpn.abcd.com failed, CA considers answer to challenge invalid.",
"activity":"Monitoring challenge status for vpn.abcd.com"
},

Configure FortiGate with port 443 for HTTPS. This can be reverted after certificate renewal.

It is possible to validate that the FortiGate/ACME service is reachable on these ports from another device.

For example, from an external server, it is possible to test with 'telnet' or 'curl' commands:

user@server:~$ telnet vpn.domain.net 80
user@server:~$ telnet vpn.domain.net 443

Output indicating the TCP connection has been established:

user@server:~$ telnet vpn.domain.net 80
Trying 12.34.56.78.
Connected to vpn.domain.net
Escape character is '^]'.

CURL:
user@server:~$ curl http://vpn.domain.net
user@server:~$ curl https://vpn.domain.net

Output showing the ACME service is reachable on the FortiGate:

user@server:~$ curl http://vpn.domain.net
<!DOCTYPE html><html><head><title>ACME Access Only</title></head><body>ACME Access Only</body></html>w

If the ports do not show as reachable, it is recommended to trace the connection upstream to see what is preventing access to the FortiGate on these ports.

The following error may occur in some cases:

Fetching  abc.fortiddns.com/.well-known/acme-challenge/ftkuFziZB5YczMNLDLKOCAaMFmdMbjvijBCFlLOpTsY:  Error getting validation data 2023/06/19 14:39:19 Starting challenges for domains: x.x.x.x:Fetching http://abc.fortiddns.com/.well-known/acme-challenge/ftkuFziZB5YczMNLDLKOCAaMFmdMbjvijBCFlLOpTsY:  Error getting validation data, problem: urn:ietf:params:acme:error:connection

This error may be due to validation failures on port 80 when trying to renew the certificate.

Follow the steps above to resolve this error.

Update regarding Let's Encrypt expiration notifications:

Let's Encrypt has released a statement noting that email notifications will no longer be provided as reminders for an expiring certificate. This means FortiGate administrators using this feature need to monitor or utilize third party tools to track certificate expiration. For more information, see Ending Support for Expiration Notification Emails.

Related documents:

• Technical Tip: Expiring Let’s Encrypt Certificates

• ACME certificate support (FortiGate v7.0.0).

• ACME certificate support (FortiGate v7.2.0).

• Troubleshooting Tip: Let's Encrypt certificate renewal fails with 'timeout during connect (likely firewall problem)' error

• Troubleshooting Tip: FortiGate - workarounds for HTTPSD Crashes with ACME enabled

• Technical Tip: Meaning of the error message 'Error creating a new order :: too many certificates already issued for: <domain.com>' while creating a new ACME certificate (Let’s Encrypt) 

• Troubleshooting Tip: Let's Encrypt certificate renewal failed with error: 'Domain authorization failed and CA considers answer to challenge invalid'

• Changes in default values