Technical Tip: IPsec VPN CA certificates must be re-issued to all devices after a FortiManager upgrade

• Roll-back scenario: To allow easier roll back (using FortiManager VM snapshot or a FortiManager backup file), it is recommended to disable the Auto-Update feature before creating the snapshot/backup:

config system admin setting    set auto-update disable end​

This way, upon FortiManager roll-back, the last revisions and device databases can be directly installed to the managed FortiGates after restoring the FortiManager system. 

If auto-update is enabled, the new certificates, created by this procedure, would overwrite the corresponding device database objects and reverting the configuration would include many extra steps for reverting and reloading the old device revisions. This is especially important for FortiManager units managing a lot of FortiGates.

1. Architecture Details: The architecture example used in this article is a basic hub and spoke topology with three FortiGates. Screenshots were taken on a 7.2.5 FortiManager. The 7.4.2 GUI features some differences, but the overall procedure remains the same. 

2. Implementation:

• Upgrade the FortiManager. 
  
• Warning: Once the FortiManager is upgraded to 7.4.2+ or 7.2.5+, do not perform any installations before applying this procedure. Otherwise, the FortiGates will be unable to renegotiate the VPN tunnels until the changes below are applied and successfully installed.
• Deactivate auto-update: If not already disabled at the pre-upgrade steps, disable the auto-update feature now:

config system admin setting    set auto-update disable end​

This will ensure that the modifications to the device databases are not overwritten by an auto-retrieve.

• Back up the FortiManager configuration (of the new firmware version): 
  Go to System Settings -> Dashboard and select 'Backup'.

• Enable the visibility of the CA certificates:
  Go to Policy & Objects -> Tools and select 'Feature Visibility'. Then, under 'Advanced', check 'CA Certificates'.

• Verify that the new <ADOM>_CA3 certificate is generated successfully.
  Go to Policy & Objects -> Object Configurations -> Advanced -> CA Certificates.
  CA2 is the former ADOM authority and CA3 is the new one.

• Renew device certificates: 
  Go to Device Manager -> Provisioning Template -> Certificate Templates
  Select your template  -> More and select 'Generate'.  

• When prompted, select the required devices and select 'OK'.

Note: Depending on the FortiManager hardware specs (mostly single-core CPU performance), it may take 5-10 seconds to generate one certificate.
For example, with 500 managed FortiGates, it may take about 40 to 80 minutes to complete this task.

• Modify the Peers: The newly generated certificates do not include the VDOM name anymore, meaning the peer configuration must be edited. Connect to the Hub FortiGate, open 'CLI Console', and gather the output of 'show user peer'. Alternatively, the configuration can be copied from the the device revisions in FortiManager (if in sync)
  

• Use a text editor to:
  • Remove the '.<VDOM>' (.root in this example) from the 'subject' field.
  • Replace CA2 with CA3 in the 'ca' field.

The peer object names can remain as they are, since they do not affect the functionality and are difficult to change.

• Return to FortiManager and go to Device manager -> Scripts.
  • Select +Create New and select 'Script'.
    - Enter a Script Name, set the Type to 'CLI Script', specify Run Script on as Device Database and paste the previously edited data, then select 'OK'.

• Select the newly created script and select the 'Run Script' button.

  • Select the HUB FortiGate and move it to the right pane using the right arrow
    

  • Select 'Run Now' -> OK.
    

Once the script has successfully run, select 'Close'.

• Repeat the same steps to obtain the peer config from one of the spokes. Within the same Hub-Spoke topology, all spokes usually have the same peer objects for the hub(s). Then create and run a script with the modified peer(s) to all spokes.

• Install: Select Install Wizard, then select Install Device Settings (Only) and select Next. 
  Select all required devices and select Next. 
  Select Install Preview. The following should be available in the preview: 
  
  • The new certificate CA3 (under config vpn certificate ca).
  • The regenerated device certificates (under config vpn certificate local).
  • The peer modifications.
    

Close the install preview and select Install.

• Once the installation has been completed, select Finish.

3. Verify that the certificates and the peers have been successfully updated on the FortiGates. 
   Connect to the Hub and go to System -> Feature Visibility, check 'Certificates', and select 'Apply'.

• Go to System -> Certificates and verify that the CN of the local VPN certificate contains only the device name (without the .VDOM part).

• Open the CLI and check if the peers have been successfully updated.
  There should be no .<ADOM_Name> and CA2, especially in the peer group members list.

• Repeat the same on the spokes.
• Confirm that the VPN tunnels are UP.

4. In FortiManager re-enable auto-update:

config system admin setting    set auto-update enable end​

5. Removing the old CA2 certificate from the FortiGates (optional):
   The old CA named '<ADOM>_CA2' is normally not used anymore and can be deleted from FortiManager. However, this will not delete it automatically from the devices. 

To delete CA2 from the managed FortiGates:

• Go to Device manager -> Scripts -> +Create New and select 'Script'. 
  
• Fill in a Script Name, set the Type to 'CLI Script', set Run Script on to 'Device Database' and paste the following as the script, then select OK.

config vpn certificate ca

delete "root_CA2"

end

• Select the newly created script and select the Run Script button.
• Select all required devices, move them to the right pane using the right arrow and select Run Now.
• A confirmation window will appear. Select OK. Once the script has successfully run, select Close.

• The next installation will delete CA2 certificate from the FortiGates.