| Description | The article describes how to troubleshoot the ACME certificate renewal/ Provision issue due to an error 'Timeout during connect (likely firewall problem), problem: urn:ietf:params:acme:error:connection'. |
| Scope | FortiGate v7.0 and Above. |
| Solution |
At the time of renewal/provision of ACME certificate, FortiGate shows an error message 'Timeout during connect (likely firewall problem), problem: urn:ietf:params:acme:error:connection' that states the FortiGate is not able to contact the ACME server for renewal/provision.
Renew or Provision the ACME certificate: Automatically provision a certificate - FortiGate administration guide.
To confirm the issue, check the ACME log when the ACME client initiates the process to provision or renew certificates.
In the 'Details' section it will show the following error:
Assessing current status
Further:
Starting challenges for domains: During secondary validation: x.x.x.x: Fetching http://firewall.bktfamilylaw.com/.well-known/acme-challenge/iC7nHEx6kdK4caQyIMBBziF0f4ennBNtT2KbiRzj... Timeout during connect (likely firewall problem), problem: urn:ietf:params:acme:error:connection
The issue is due to the connectivity. It is because of the local-in-policy on FortiGate that blocks certain geo-locations during the provision/renewal of the certificate. For the time being disable the local-in-policy that limits the geolocation and begin the renewal/provision process. Once it is successful, enable the local-in-policy. It is due to Let's Encrypt servers being located in different geo-locations.
The second reason is if there are any upstream devices like firewalls and traffic passing through the upstream device then keep ports 80 and 443 open. Allow the connection from the ACME client to the server. Make sure that there is no geolocation-based block over ports 80 and 443 on the upstream firewall.
The third reason can be 'trusthost' configured for the super_admin user, after removing trusted hosts from the administrator configuration, FortiGate allows administrative access to Let's Encrypt CA via management protocols. Once it is successful, configure 'trusthost' back again in the administrator.
The fourth reason can be an incorrect selection of the ACME interface; make sure the WAN interface is selected. It can be checked under the System -> Settings.
The fifth reason to correct urn:ietf:params:acme:error:connection':
Go to System -> Settings and leave the default ports as HTTPS (443) and HTTP (80). Under VPN Options -> SSL-VPN Settings, use the default port 443. This default setting is to allow the LetsEncrypt server to communicate correctly and renew the certificate. Once the certificate has been successfully renewed, it is possible to return to the previously configured ports.
Another reason for the timeout is when there is a VIP configured on the listening interface where ACME is configured. The guidelines recommend that the configured ACME interface must not have any VIPs or port forwarding on port 80 (HTTP) or 443 (HTTPS). Refer to Automatically provision a certificate - FortiGate administration guide
Note: The maximum number of attempts to create an ACME certificate is 5. After crossing the maximum number limit, the next attempt will be after one hour. |
