Technical Tip: FortiProxy is not connecting to FortiManager with incorrect certificate message

A Physical or hardware FortiProxy device can not connect to the FortiManager when the Technical Tip: How to integrate FortiProxy with FortiManager article is followed. The GUI shows the error below in FortiProxy.

The FortiManager debug shows that the FortiProxy is sending the certificate with the incorrect CN, and it does not match the serial Number of the FortiProxy.

kvm74 # diagnose debug timestamp enable

kvm74 # diagnose debug application fgfmsd -1
fgfmsd debug filter: disable

kvm74 # diagnose debug enable

2026-02-03 13:01:09 get auth
serialno=FPX2KXXXXXXXX
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiProxy-2000E
fos_ver=700
minor=4
patch=5
build=616
branch=616
maxvdom=5
fg_ip=10.5.131.8
hostname=FPX2KE-1
harddisk=yes
biover=00020011
harddisk_size=1907200
logdisk_size=1876175
mgmt_mode=normal
enc_flags=0
mgmtip=10.5.131.8
mgmtport=443

2026-02-03 13:01:09 FGFMs(probing...): __get_handler:1107: serial number (FPX2KEXXXXXXX) in 'get' message doesn't match the subject C
N (FortiGate) in peer's certificate.  -------> Incorrect CN

2026-02-03 13:01:10 FGFMs(probing...): Cleanup session 0x5642e58b59a0, 10.5.131.8.
2026-02-03 13:01:10 FGFMs(probing...): Destroy session 0x5642e58b59a0, 10.5.131.8.
2026-02-03 13:01:12 FGFMs(probing...): Create session 0x5642e58b59a0.

As per the FortiProxy, the default Factory certificate shows the CN as 'FortiGate' instead of the serial number of the FortiProxy. 

FPX2KE-1 # get vpn certificate local details

== [ Fortinet_Factory ]
Name: Fortinet_Factory
Subject: C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = FortiGate, CN = FortiGate, emailAddress = support@fortinet.com
Issuer: C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = Certificate Authority, CN = support, emailAddress = support@fortinet
.com
Valid from: 2015-07-16 00:33:11 GMT
Valid to: 2038-01-19 03:14:07 GMT

This issue is seen only for the Hardware or Physical FortiProxy devices, and it is fixed in version 7.4.9 of FortiProxy as part of issue ID 1143143.

One of the workarounds for the issue is to set a custom certificate for the communication between the FortiProxy and FortiManager instead of using the Factory default certificate. Refer to the article Technical Tip: Utilizing factory and custom certificates in tandem for the FortiGate-to-FortiManager (FGFM) protocol.