New Member

Question

Add Device to Fortmanger serial Number Certificate Problem

Forum|Forum|1 month ago
June 14, 2026
4 replies
52 views

Hi,

For training purposes, I have installed FortiManager 8.0.0 on VMware and FortiGate 8.0.0, but I am encountering the following problem:

I have already tried using the SSL certificate whose serial number is specified in the CN field, but the issue still persists.

fgfm-allow-vm is enabled

msanjaypadma

Staff

Hi @alosman ,

Refer this thread , hope that it will help you.

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

Thanks, Mayur Padma

sjoshi

Staff

Hi @alosman

Can you collect below logs while trying to connect FMG.

Collect debug log outputs in FortiGate:

diagnose debug reset
diagnose debug application fgfmd -1
diagnose debug console timestamp enable
diagnose debug enable

Collect debug log outputs in FortiManager:

diagnose debug reset
diagnose debug application fgfmsd -1 <Device-Name> <----- Filter (DeviceName) related messages. Use <DeviceName>="" to reset. Multiple device names should be separated by commas, e.g., Host1, Host2. Can be filtered by IP (x.x.x.x) as well.
diagnose debug timestamp enable
diagnose debug enable

» diagnose debug disable » to stop it

Thanks, Salon

alosmanAuthor

New Member

@sjoshi On Fortgate:

2026-06-14 18:20:29 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:20:30 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:20:30 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:20:36 FGFMs: Incoming 192.168.0.10 local 192.168.0.30.
2026-06-14 18:20:36 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:20:36 FGFMs: checking existing sessions...
2026-06-14 18:20:36 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:20:36 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:20:36 FGFMs: before SSL initialization
2026-06-14 18:20:36 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:20:36 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:36 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:36 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:20:36 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:20:36 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:20:36 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:20:36 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:20:36 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:20:36 FGFMs: The peer certificate FMG-VMTM26006853 is unknown!
2026-06-14 18:20:36 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:20:36 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:20:36 FGFMs: SSLv3/TLS read finished
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:20:36 FGFMs: SSLv3/TLS write finished
2026-06-14 18:20:36 FGFMs: SSL negotiation finished successfully
2026-06-14 18:20:36 FGFMs: client:send
get auth
fg_ip=192.168.0.30
mgmtip=192.168.0.30
mgmtport=443

2026-06-14 18:20:36 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:20:37 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:20:37 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:20:45 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:20:45 FGFMs: setting session 0x5594f8389200 exclusive=0
2026-06-14 18:20:45 FGFMs: Connect to 192.168.0.10:541, local 192.168.0.30:16634.
2026-06-14 18:20:45 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:20:45 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:20:45 FGFMs: Set self_initiated = 1
2026-06-14 18:20:45 FGFMs: before SSL initialization
2026-06-14 18:20:45 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:20:45 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:20:45 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:45 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:45 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:20:45 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:20:45 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:46 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:20:46 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:20:46 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:20:46 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:20:46 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:20:46 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:20:46 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:20:46 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:20:46 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:20:46 FGFMs: SSLv3/TLS read finished
2026-06-14 18:20:46 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:20:46 FGFMs: SSLv3/TLS write finished
2026-06-14 18:20:46 FGFMs: SSL negotiation finished successfully
2026-06-14 18:20:46 FGFMs: client:send
get auth
serialno=FGVMEVIY4IPWHN15
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=800
minor=0
patch=0
build=167
branch=167
maxvdom=2
fg_ip=192.168.0.30
hostname=FGVMEVIY4IPWHN15
harddisk=no
biover=04000002
mgmt_mode=normal
enc_flags=0
mgmtip=192.168.0.30
mgmtport=443

2026-06-14 18:20:46 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:20:46 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:20:46 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:01 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:21:01 FGFMs: setting session 0x5594f8389200 exclusive=0
2026-06-14 18:21:01 FGFMs: Connect to 192.168.0.10:541, local 192.168.0.30:16636.
2026-06-14 18:21:01 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:21:01 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:21:01 FGFMs: Set self_initiated = 1
2026-06-14 18:21:01 FGFMs: before SSL initialization
2026-06-14 18:21:01 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:21:01 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:01 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:01 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:01 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:21:01 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:21:01 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:21:01 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:21:01 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:21:01 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:21:01 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:21:01 FGFMs: SSLv3/TLS read finished
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:21:01 FGFMs: SSLv3/TLS write finished
2026-06-14 18:21:01 FGFMs: SSL negotiation finished successfully
2026-06-14 18:21:01 FGFMs: client:send
get auth
serialno=FGVMEVIY4IPWHN15
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=800
minor=0
patch=0
build=167
branch=167
maxvdom=2
fg_ip=192.168.0.30
hostname=FGVMEVIY4IPWHN15
harddisk=no
biover=04000002
mgmt_mode=normal
enc_flags=0
mgmtip=192.168.0.30
mgmtport=443

2026-06-14 18:21:01 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:21:02 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:02 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:17 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:21:17 FGFMs: setting session 0x5594f8389200 exclusive=0
2026-06-14 18:21:17 FGFMs: Connect to 192.168.0.10:541, local 192.168.0.30:16638.
2026-06-14 18:21:17 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:21:17 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:21:17 FGFMs: Set self_initiated = 1
2026-06-14 18:21:17 FGFMs: before SSL initialization
2026-06-14 18:21:17 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:21:17 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:17 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:17 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:17 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:21:17 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:21:17 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:21:17 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:21:17 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:21:17 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:21:17 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:21:17 FGFMs: SSLv3/TLS read finished
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:21:17 FGFMs: SSLv3/TLS write finished
2026-06-14 18:21:17 FGFMs: SSL negotiation finished successfully
2026-06-14 18:21:17 FGFMs: client:send
get auth
serialno=FGVMEVIY4IPWHN15
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=800
minor=0
patch=0
build=167
branch=167
maxvdom=2
fg_ip=192.168.0.30
hostname=FGVMEVIY4IPWHN15
harddisk=no
biover=04000002
mgmt_mode=normal
enc_flags=0
mgmtip=192.168.0.30
mgmtport=443

2026-06-14 18:21:17 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:21:18 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:18 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:33 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:21:33 FGFMs: setting session 0x5594f8389200 exclusive=0
2026-06-14 18:21:33 FGFMs: Connect to 192.168.0.10:541, local 192.168.0.30:16644.
2026-06-14 18:21:33 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:21:33 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:21:33 FGFMs: Set self_initiated = 1
2026-06-14 18:21:33 FGFMs: before SSL initialization
2026-06-14 18:21:33 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:21:33 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:21:33 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:34 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:34 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:34 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:21:34 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:34 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:34 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:34 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:21:34 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:21:34 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:21:34 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:21:34 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:21:34 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:21:34 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:21:34 FGFMs: SSLv3/TLS read finished
2026-06-14 18:21:34 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:21:34 FGFMs: SSLv3/TLS write finished
2026-06-14 18:21:34 FGFMs: SSL negotiation finished successfully
2026-06-14 18:21:34 FGFMs: client:send
get auth
serialno=FGVMEVIY4IPWHN15
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=800
minor=0
patch=0
build=167
branch=167
maxvdom=2
fg_ip=192.168.0.30
hostname=FGVMEVIY4IPWHN15
harddisk=no
biover=04000002
mgmt_mode=normal
enc_flags=0
mgmtip=192.168.0.30
mgmtport=443

2026-06-14 18:21:34 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:21:35 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:35 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:50 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:21:50 FGFMs: setting session 0x5594f8389200 exclusive=0
2026-06-14 18:21:50 FGFMs: Connect to 192.168.0.10:541, local 192.168.0.30:16646.
2026-06-14 18:21:50 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:21:50 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:21:50 FGFMs: Set self_initiated = 1
2026-06-14 18:21:50 FGFMs: before SSL initialization
2026-06-14 18:21:50 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:21:50 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:50 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:21:50 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:21:50 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:21:50 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:21:50 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:21:50 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:21:50 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:21:50 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:21:50 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:21:50 FGFMs: SSLv3/TLS read finished
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:21:50 FGFMs: SSLv3/TLS write finished
2026-06-14 18:21:50 FGFMs: SSL negotiation finished successfully
2026-06-14 18:21:50 FGFMs: client:send
get auth
serialno=FGVMEVIY4IPWHN15
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=800
minor=0
patch=0
build=167
branch=167
maxvdom=2
fg_ip=192.168.0.30
hostname=FGVMEVIY4IPWHN15
harddisk=no
biover=04000002
mgmt_mode=normal
enc_flags=0
mgmtip=192.168.0.30
mgmtport=443

2026-06-14 18:21:50 FGFMs: SSL Alert read: fatal unknown
2026-06-14 18:21:51 FGFMs: Cleanup session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:21:51 FGFMs: Destroy session 0x5594f8389200, 192.168.0.10.
2026-06-14 18:22:06 FGFMs: Create session 0x5594f8389200.
2026-06-14 18:22:06 FGFMs: setting session 0x5594f8389200 exclusive=0
2026-06-14 18:22:06 FGFMs: Connect to 192.168.0.10:541, local 192.168.0.30:16648.
2026-06-14 18:22:06 FGFMs: Load Cipher [DES:!3DES:!ECDH:!DHE:!AES:!CAMELLIA:!SEED:!RC4:!PSK:!IDEA:!ARIA:@STRENGTH:@SECLEVEL=0]
2026-06-14 18:22:06 FGFMs: Load TLS 1.3 Cipher [TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256]
2026-06-14 18:22:06 FGFMs: Set self_initiated = 1
2026-06-14 18:22:06 FGFMs: before SSL initialization
2026-06-14 18:22:06 FGFMs: CA to broadcast: subject fortinet-ca2, issuer fortinet-ca2
2026-06-14 18:22:06 FGFMs: Broadcast 1 CA subject names to FMG
2026-06-14 18:22:06 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:22:06 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:22:06 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:22:06 FGFMs: SSLv3/TLS write change cipher spec
2026-06-14 18:22:06 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:22:07 FGFMs: SSLv3/TLS write client hello
2026-06-14 18:22:07 FGFMs: SSLv3/TLS read server hello
2026-06-14 18:22:07 FGFMs: TLSv1.3 read encrypted extensions
2026-06-14 18:22:07 FGFMs: SSLv3/TLS read server certificate request
2026-06-14 18:22:07 FGFMs: Verified CA certificate 2: (subject: fortinet-ca2, issuer: fortinet-ca2)
2026-06-14 18:22:07 FGFMs: Verified CA certificate 1: (subject: fortinet-subca2001, issuer: fortinet-ca2)
2026-06-14 18:22:07 FGFMs: Verified peer certificate 0: (subject: FMG-VMTM26006853, issuer: fortinet-subca2001)
2026-06-14 18:22:07 FGFMs: SSLv3/TLS read server certificate
2026-06-14 18:22:07 FGFMs: TLSv1.3 read server certificate verify
2026-06-14 18:22:07 FGFMs: SSLv3/TLS read finished
2026-06-14 18:22:07 FGFMs: SSLv3/TLS write client certificate
2026-06-14 18:22:07 FGFMs: SSLv3/TLS write finished
2026-06-14 18:22:07 FGFMs: SSL negotiation finished successfully
2026-06-14 18:22:07 FGFMs: client:send
get auth
serialno=FGVMEVIY4IPWHN15
mgmtid=00000000-0000-0000-0000-000000000000
platform=FortiGate-VM64
fos_ver=800
minor=0
patch=0
build=167
branch=167
maxvdom=2
fg_ip=192.168.0.30
hostname=FGVMEVIY4IPWHN15
harddisk=no
biover=04000002
mgmt_mode=normal
enc_flags=0
mgmtip=192.168.0.30
mgmtport=443

On Fortimanager:

FMG-VM64-cfcb0e68 # 2026-06-14 18:20:30 proxy_session.c,__session_frontend_accept_core,859: 192.168.0.30:16632 -> 192.168.0.10:541.
2026-06-14 18:20:30 __use_cert,763: start idx = 0
2026-06-14 18:20:30 use certificate issuer = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com
2026-06-14 18:20:30 subject = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=FortiManager/CN=FMG-VMTM26006853/emailAddress=support@fortinet.com
2026-06-14 18:20:30 proxy_session.c,__proxy_session_cleanup, 124:cnt=0, session=0x557fa7f0da8c.
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=0, TLSv1.3 before SSL initialization
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=0, TLSv1.3 before SSL initialization
2026-06-14 18:20:30 Got client SNI information : sni=(null)
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=22, TLSv1.3 SSLv3/TLS read client hello
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=24, TLSv1.3 SSLv3/TLS write server hello
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=39, TLSv1.3 SSLv3/TLS write change cipher spec
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=50, TLSv1.3 TLSv1.3 early data
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=50, TLSv1.3 TLSv1.3 early data
2026-06-14 18:20:30 Got client SNI information : sni=(null)
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=22, TLSv1.3 SSLv3/TLS read client hello
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=24, TLSv1.3 SSLv3/TLS write server hello
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=41, TLSv1.3 TLSv1.3 write encrypted extensions
2026-06-14 18:20:30 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2003
2026-06-14 18:20:30 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com
2026-06-14 18:20:30 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com
2026-06-14 18:20:30 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2001/emailAddress=support@fortinet.com
2026-06-14 18:20:30 Svr broadcast 4 CA subject names to peer
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=28, TLSv1.3 SSLv3/TLS write certificate request
2026-06-14 18:20:30 The CA of No.1 local cert:
/C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com
2026-06-14 18:20:30 Remote CA: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com
2026-06-14 18:20:30 The CA of No.2 local cert:
/C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2001/emailAddress=support@fortinet.com
2026-06-14 18:20:30 Remote CA: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com
2026-06-14 18:20:30 They share the same root CA, but with different immediate CAs
2026-06-14 18:20:30 Find cert idx=1, peer_ca = 1
2026-06-14 18:20:30 __use_cert,763: start idx = 1
2026-06-14 18:20:30 use certificate issuer = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2001/emailAddress=support@fortinet.com
2026-06-14 18:20:30 subject = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=FortiManager/CN=FMG-VMTM26006853/emailAddress=support@fortinet.com
2026-06-14 18:20:30 Use cert idx=1 by peer_ca = 1
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=25, TLSv1.3 SSLv3/TLS write certificate
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=44, TLSv1.3 TLSv1.3 write server certificate verify
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=40, TLSv1.3 SSLv3/TLS write finished
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=50, TLSv1.3 TLSv1.3 early data
2026-06-14 18:20:30 __info_callback,1147, pid=30201: role=svr,state=50, TLSv1.3 TLSv1.3 early data
2026-06-14 18:20:30 TLSv1.3 write fatal alert: unknown
2026-06-14 18:20:30 fw_proto_ssl.c,1180: TLSv1.3 error
2026-06-14 18:20:30 fw_proto_ssl.c,__get_error,1760, err=167772359, error:0A0000C7:SSL routines::peer did not return a certificate.
2026-06-14 18:20:30 fw_proto_ssl.c,__get_error,1774, ret=-4, error=1, errno=5,Input/output error.
2026-06-14 18:20:30 proxy_session.c,__negotiate,235: frontend accept error.
2026-06-14 18:20:30 proxy_session.c,__proxy_session_cleanup, 124:cnt=0, session=0x557fa7eeaf1c.
2026-06-14 18:20:37 Chkperm Response [gui flatui_proxy:13718:1]:
2026-06-14 18:20:37 { "id": 1, "result": [{ "status": { "code": 0, "message": "OK"}, "url": "start\/probe\/session"}], "session": 6444}

2026-06-14 18:20:37 Request:
2026-06-14 18:20:37 { "chkperm result": [{ "status": { "code": 0, "message": "OK"}, "url": "start\/probe\/session"}], "client": "gui flatui_proxy:13718", "id": 1, "method": "exec", "params": [{ "data": { "detect_only": 1, "force_probe": 0, "ip": "192.168.0.30", "passwd": "******", "usr": "admin"}, "target start": 4, "url": "start\/probe\/session"}], "root": "fgfm", "session": 6444}

2026-06-14 18:20:37 FGFMs: 2026-06-14 18:20:37 Entering __probe_device_core 1355.
2026-06-14 18:20:37 FGFMs: 2026-06-14 18:20:37 __probe_device_core 1367: user=admin, passwd=******, force_probe=0, detect_only=1.
2026-06-14 18:20:37 FGFMs(probing...): 2026-06-14 18:20:37 Create session 0x557fa7ee46ec.
2026-06-14 18:20:37 proxy_session.c,__session_backend_accept,932: incomoing to .
2026-06-14 18:20:37 proxy_session.c,__proxy_session_cleanup, 124:cnt=0, session=0x557fa7eeaf1c.
2026-06-14 18:20:37 FGFMs(probing...): 2026-06-14 18:20:37 Connect to 192.168.0.30.
2026-06-14 18:20:37 __on_backend_accept,384:
2026-06-14 18:20:37 addr:{0.0.0.0:0->2026-06-14 18:20:37 192.168.0.30:541},2026-06-14 18:20:37 }2026-06-14 18:20:37
2026-06-14 18:20:37 proxy_session.c,__on_backend_accept,390: 0.0.0.0:0 -> 192.168.0.30:541.
2026-06-14 18:20:37 proxy_session.c,__backend_ssl_negotiate_enter,416: 192.168.0.10:22390 -> 192.168.0.30:541.
2026-06-14 18:20:37 __use_cert,763: start idx = 0
2026-06-14 18:20:37 use certificate issuer = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com
2026-06-14 18:20:37 subject = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=FortiManager/CN=FMG-VMTM26006853/emailAddress=support@fortinet.com
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=0, TLSv1.3 before SSL initialization
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=0, TLSv1.3 before SSL initialization
2026-06-14 18:20:37 Got client SNI information : sni=(null)
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=22, TLSv1.3 SSLv3/TLS read client hello
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=24, TLSv1.3 SSLv3/TLS write server hello
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=39, TLSv1.3 SSLv3/TLS write change cipher spec
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=50, TLSv1.3 TLSv1.3 early data
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=50, TLSv1.3 TLSv1.3 early data
2026-06-14 18:20:37 Got client SNI information : sni=(null)
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=22, TLSv1.3 SSLv3/TLS read client hello
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=24, TLSv1.3 SSLv3/TLS write server hello
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=41, TLSv1.3 TLSv1.3 write encrypted extensions
2026-06-14 18:20:37 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2003
2026-06-14 18:20:37 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com
2026-06-14 18:20:37 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com
2026-06-14 18:20:37 CA to broadcast: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2001/emailAddress=support@fortinet.com
2026-06-14 18:20:37 Svr broadcast 4 CA subject names to peer
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=28, TLSv1.3 SSLv3/TLS write certificate request
2026-06-14 18:20:37 The CA of No.1 local cert:
/C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com
2026-06-14 18:20:37 Remote CA: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com
2026-06-14 18:20:37 The CA of No.2 local cert:
/C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2001/emailAddress=support@fortinet.com
2026-06-14 18:20:37 Remote CA: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com
2026-06-14 18:20:37 They share the same root CA, but with different immediate CAs
2026-06-14 18:20:37 Find cert idx=1, peer_ca = 1
2026-06-14 18:20:37 __use_cert,763: start idx = 1
2026-06-14 18:20:37 use certificate issuer = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-subca2001/emailAddress=support@fortinet.com
2026-06-14 18:20:37 subject = /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=FortiManager/CN=FMG-VMTM26006853/emailAddress=support@fortinet.com
2026-06-14 18:20:37 Use cert idx=1 by peer_ca = 1
2026-06-14 18:20:37 __info_callback,1147, pid=30200: role=svr,state=25, TLSv1.3 SSLv3/TLS write certificate

sjoshi

Staff

Hi @alosman

The peer certificate FMG-VMTM26006853 is unknown!
This suggests that there may be an issue with certificate trust between the FortiGate and FortiManager.
Try:
config system global
set fgfm-peercert-withoutsn enable
end

You can try using custom certificate https://community.fortinet.com/fortimanager-27/technical-tip-setup-custom-certificate-for-fgfm-protocol-127341

Thanks, Salon

jiahoong112

Staff

You seem to be hitting this issue:

This is seen with FortiGate VMs where the fortinet_factory certificate does not contain the Serial Number, so it gets rejected by FMG.

Sign up

Login with SSO

Login to the community

Login with SSO