Troubleshooting Tip: FortiCloud Registration Failure: Error Getting FortiGate Cloud Domain, HTTP 400

[sdebnath]

Description	This article explains the cause behind 'FortiCloud registration failures' and the 'HTTP 400 error' ('Error getting FortiGate Cloud domain') despite all configurations appearing correct.
Scope	FortiGate, FortiCloud.
Solution	The registration with FortiCloud is crucial to enable advanced features such as remote management, centralized logging, firmware updates, and subscription service activation for FortiGates. The administrators managing the FortiGate LENC models (Low Encryption devices) are encountering FortiCloud registration failures (see the screenshot below) when the configurations, for example, DNS resolution and FortiGuard reachability, are working as expected.  Run the debugs using the following commands : diagnose debug console timestamp enable diagnose debug application forticldd -1 diagnose debug enable To disable the debugs: diagnose debug disable diagnose debug reset The FortiCloud debug log captures the error during the registration attempt: [1063] ssl_connect: SSL_connect failes: error:0A00042E:SSL routines::tlsv1 alert protocol version [870] tcps_connect: 154.52.10.103:443 -- ret -1, state 0x7(Failed) -> 0x7(Failed) [877] tcps_connect: tcps_connect failed: ssl_connect() failed: 0 (error:00000000:lib(0)::reason(0)) According to the FortiOS Administration Guide, the minimum TLS version for outbound connections from a FortiGate can be configured using the CLI. Verify this information by visiting TLS configuration  config system global set ssl-min-proto-version {SSLv3 | TLSv1 | TLSv1-1 | TLSv1-2 | TLSv1-3} end By default, this setting is TLSv1.2. The FortiGate will attempt to negotiate a connection using the configured version or higher. If the server that the FortiGate is connecting to does not support the specified version, the connection will not be established. Fortinet has updated its default settings in v6.2.0 and later versions to set TLSv1.2 as the default minimum TLS version for various services, including FortiCloud. See this document: Minimum version of TLS services automatically changed  If a FortiGate, such as certain LENC models, does not support TLS 1.2, it will fail to complete the SSL/TLS handshake with FortiCloud, leading to registration failure. For troubleshooting registration issues with FortiCloud towards resolution, Fortinet recommends ensuring that the minimum TLS version is set to TLSv1.2 and proceeding to upgrade to a Full Encryption License for these LENC models, which can be verified with more detailed information about the TLS configuration and Low Encryption (LENC) device. Related documents: Technical Tip: Low Encryption (LENC) device FAQ TLS configuration  Technical Tip: How to register and activate a FortiGate Cloud account