Hi there, I'm trying to generate an ACME cert on my FortiGate, just as I've done on my EMS server, but it always fails with a "Timeout during connect (likely firewall problem)" error: Port 80 is wide open to the world and you can see the traffic coming in when running a diag sniffer. From me running a curl against http://vpn.<mydomain>.com: I'm at a loss. Does anyone have any ideas or suggestions? Thanks!

Visitor III

Solved

Generating ACME SSL cert always fails with "Timeout during connect (likely firewall problem)"

Forum|Forum|1 year ago
February 5, 2025
2 replies
2490 views

Hi there,

I'm trying to generate an ACME cert on my FortiGate, just as I've done on my EMS server, but it always fails with a "Timeout during connect (likely firewall problem)" error:

Screenshot 2025-02-05 at 10.50.00.png

Port 80 is wide open to the world and you can see the traffic coming in when running a diag sniffer. From me running a curl against http://vpn.<mydomain>.com:

Screenshot 2025-02-05 at 10.53.59.png

I'm at a loss. Does anyone have any ideas or suggestions?

Thanks!

Best answer by AEK

Hi

Check here how the challenge is done.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Acme-on-the-FortiGate-causes-Security-Compliance/ta-p/294724

Maybe the ACME server is not able to perform the challenge, probably because your 443 port is closed (TLS-ALPN-01 on 443 is the default for challenge).

AEKAnswer

SuperUser

Hi

Check here how the challenge is done.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Acme-on-the-FortiGate-causes-Security-Compliance/ta-p/294724

Maybe the ACME server is not able to perform the challenge, probably because your 443 port is closed (TLS-ALPN-01 on 443 is the default for challenge).

AEK

nopethanksAuthor

Visitor III

If anyone has the same issue later, I've got my HTTPS port set to something other than 443 which enabled me to set the HTTP port to 443 which then was able to communicate with Let's Encrypt. I have "Redirect to HTTPS" enabled to the actual HTTPS port which is blocked from public access.

I think the way the EMS server has this implemented is the right way but at least this config seems to work.

Thanks again!

Sign up

Login with SSO

Login to the community

Login with SSO