Staff

Troubleshooting Tip: Action required: update FDN certificates for FortiSOAR instances, deadline October 10, 2026

0 replies
2528 views

Description

This article describes important action that must be taken with FortiSOAR instances.

The FortiGuard Distribution Network (FDN) will update its CA certificate on 10 October 2026.

All FortiSOAR instances must install the updated certificates before this date to maintain connectivity and normal system operation.

Failure to complete this update will result in:

Loss of communication with the FortiGuard Distribution Network (FDN).
Disruption of license synchronization.
FortiSOAR is becoming non-operational.

If the certificates are not updated, the FortiSOAR UI will display the following error message for up to 72 hours (on firmware version 7.6.0 and later) or 24 hours (on versions earlier than 7.6.0):

"FSR-Auth-003: License Entitlement Sync failed on node <node_name>. Ensure that https://globalupdate.fortinet.com is accessible from your environment. If the issue still persists, contact support."

This update is mandatory and must be completed immediately to avoid service interruption.

Scope All existing FortiSOAR instances.

Solution

Update the certificates by performing the following steps on all existing FortiSOAR instances, including:

Each FortiSOAR instance.
Each node in a high-availability cluster.
Both master and tenant nodes in MSSP environments.
Each FortiSOAR Cloud instance.

SSH into the FortiSOAR VM and log in.
Download the script:

For all versions earlier than 7.6.5, such as 7.6.4, 7.5.x, 7.3.x:

sudo wget https://repo.fortisoar.fortinet.com/fortisoar/scripts/update-fdn-truststore.bin

For only version 7.6.5:

wget https://repo.fortisoar.fortinet.com/fortisoar/scripts/replace-fdn-truststore.bin

Run the script:

For all versions earlier than 7.6.5:

sudo chmod +x update-fdn-truststore.bin

sudo ./update-fdn-truststore.bin

Successful execution of the script returns the following CA entries in the output:

'digicert_ev_rsa_ca_g2' 'digicert_global_root_g2'

For only version 7.6.5:

sudo chmod +x replace-fdn-truststore.bin

sh replace-fdn-truststore.bin

Successful execution of the script returns the following 'Success' message:

Done. Truststore updated and cyops-auth restarted successfully.

Log in to the FortiSOAR UI and confirm that no license synchronization errors are displayed.

Important:
Run this procedure on every FortiSOAR instance and after each upgrade until further notice, as the upgrade process overwrites the certificates with default values. This procedure is required until the upcoming release and will not be necessary for subsequent releases.

Sign up

Login with SSO

Login to the community

Login with SSO