Troubleshooting Tip: Unable to configure auto-regenerate-days for NDES-generated certificates on FortiGate

Description

This article describes an issue with configuring auto-regenerate-days for NDES-generated certificates on FortiGate, where the user is unable to set the value for auto-regenerate-days due to the CLI parser setting the value for private-key and certificate as mandatory for any change through the CLI.

Scope

FortiGate.

Solution

The user is unable to set the value for auto-regenerate-days due to the CLI parser setting the value for private-key and certificate as mandatory for any change through the CLI.

To configure auto-regenerate-days for NDES-generated certificates on FortiGate, follow these steps:

1. Use the batch function of the FortiGate to bypass the CLI parser function for mandatory values by buffering the commands.
   
   

2. Run the following command to configure certificate settings and specify the auto-regenerate days.

execute batch start
    configure vpn certificate setting
        set auto-regenerate-days <days>
    execute batch
end

3. Output of the certificate is retrieved successfully via SCEP:

FortiGate-401E # config vpn certificate local
FortiGate-401E (local) # edit scep-renewable
FortiGate-401E (scep-renewable) # get
name : scep-renewable
password : *
comments :
private-key : *
certificate :
Subject: OU = QA, CN = 10.1.100.5
Issuer: C = CA, ST = BC, L = Burnaby, O = Fortinet, OU = QA, CN = Eternity-CA
Valid from: 2021-01-22 15:38:37 GMT
Valid to: 2021-01-23 15:38:37 GMT
Fingerprint: A7:70:FB:A9:F8:4F:74:44:69:34:E2:7B:29:ED:EF:22
Root CA: No
Version: 3
Serial Num:
98:96:88
Extensions:
Name: X509v3 Basic Constraints
Critical: yes
Content:
CA:FALSE
Name: X509v3 Subject Key Identifier
Critical: no
Content:
89:C3:DC:9E:F6:F1:77:39:35:6B:62:CF:D5:0F:55:CF:8D:61:2E:04
Name: X509v3 Authority Key Identifier
Critical: no
Content:
keyid:38:61:67:77:10:28:D1:28:D1:EC:4E:20:DB:1B:7F:4C:72:1C:6A:55
DirName:/C=CA/ST=BC/L=Burnaby/O=Fortinet/OU=QA/CN=Eternity-CA
serial:BF:B6:B6:B9:24:73:9F:5D
Name: X509v3 Key Usage
Critical: no
Content:
Digital Signature, Key Encipherment

Name: X509v3 Extended Key Usage
Critical: no
Content:
1.3.6.1.5.7.8.2.2, TLS Web Server Authentication, TLS Web Client Authentication, IPSec End System
state : OK
scep-url : http://172.0.0.2/cert/scep
range : global
source : user
source-ip : 0.0.0.0
ike-localid-type : asn1dn
enroll-protocol : scep
auto-regenerate-days: 0
auto-regenerate-days-warning: 0
scep-password : *
ca-identifier :
name-encoding : printable
FortiGate-401E (scep-renewable) # set auto-regenerate-days 5
FortiGate-401E (scep-renewable) # end

Note: Replace <days> with the desired number of days for auto-regeneration.