Troubleshooting Tip: ACME certificate provisioning

AlexC-FTNT · ‎12-05-2024

This article describes the checklist of items for FortiGate to facilitate Let's Encrypt ACME certificate provisioning.

FortiGate v7.0+

Complete checklist and limitations for Let's Encrypt ACME certificate provisioning:

Port 80 and port 443 must be open 'temporarily' on the desired wan interface, and not used or published through a VIP/Server Load-Balance/SSLVPN or another service on FortiGate. Test by accessing both 'http://www.domain.com' and 'https://www.domain.com' (both should present the login prompt of FortiGate). Do not test by accessing http://x.x.x.x or https://x.x.x.x (domain IP). This is not used in the verification process. The domain name must be owned and it must be associated with the public IP used by FortiGate (and after certificate provisioning, by the future web server).
The WAN interface must have HTTPS and HTTP under 'allowaccess' (Loopback interface not supported, SDWAN not supported).

HTTP to HTTPS redirect must be disabled (temporarily) from System -> Settings -> Administration settings.
Local-in policies must not block traffic from ACME servers (USA location - mind if GeoIP is used).
Trusted-hosts for admin access to FortiGate must be temporarily removed to allow this external access to the ACME challenge.
Time-zone and time should be set correctly (NTP updated), according to the area where the IP is recorded.
Make sure 'dedicated-to management' is not enabled, as this will send this management traffic over the mgmt interface instead.
If the FortiGate is a VM, there are additional checks to be performed, and improvements have been introduced from v7.6.1

Related articles: