Description
This article explains how to troubleshoot an update failure on a FortiGate that occurs with a 'Server certificate failed verification' warning to check if a failed certificate is responsible.
Scope
FortiGate.
Solution
FortiGate may fail to fetch an update from FortiGuard for multiple reasons. This article will focus on certificate issues.
Follow this step-by-step process to isolate the problem.
- Check internet connection and DNS resolution:
execute ping guard.fortinet.net
execute ping service.fortiguard.net
execute ping update.fortiguard.net
If they are working as expected, a response will be received. If so, move on to step 2.
- Perform a debug-enabled update to check which process fails during the update.
diag debug reset
diag debug application update 1
diag debug enable
exec update-now<-----Triggers the update process, obtaining the output of the debug action. Let it run for around 1 minute.)
To disable and deactivate the debug process:
diag debug disable
diag debug application update 0
diag debug reset
If FortiGate is in multi-VDOM mode, the update must be run in global VDOM.
Example output:
__upd_peer_vfy[331]-Server certificate failed verification. Error: 19 (self signed certificate in certificate chain), depth: 1, subject: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com.
ssl_connect_fds[392]-Failed SSL connecting (5,0,Success)
upd_comm_connect_fds[476]-Failed SSL connect
upd_act_HA_contract_info[779]-Error updating FSCI -1
The error displays that a failed certificate verification is the cause of the problem. Run a diagnosis on hardware certificates:
diag hardware certificate
Checking Fortinet_CA.cer integrality ........Passed
Checking Fortinet_Factory.cer integrality ........Passed
Checking Fortinet_Factory.cer key-pair integrality ........Passed
Checking Fortinet_Factory.cer Serial-No. ........[Not Matched]
Checking Fortinet_Factory.cer timeliness ........Passed
Checking Fortinet_Factory.key integrality ........Passed
The [Not Matched] certificate is the root cause.
To fix this, download the highlighted certificate and open it:
The certificate 'issued to' information will most likely be missing. This information contains the FortiGate serial number from the device.
To solve this issue, perform a fresh install of the OS:
Technical Tip: Installing firmware from system reboot
Always verify the downloaded OS with checksum validation to confirm the security and integrity of the installer:
Technical Tip: How to verify downloaded firmware checksum
For a High Availability firewall, the step-by-step process to solve the issue will be simila:
- Perform 'diag hardware certificate' on both firewalls.
- It may be necessary to failover to another device due to the fact that only the master unit will perform the update. In this case, isolate which device has the certificate issue. Refer to the above process.
- As in the solution above, perform a fresh install of the OS of the affected device. See the attached .pdf file for step-by-step breaking and rebuilding instructions for an HA cluster.
- Verify the certificate bundle version is up-to-date on both units using the below command:
diagnose autoupdate versions | grep -A7 'Certificate Bundle'
There could be several reasons as shown in below command output:
Certificate Bundle
---------
Version: 1.00052
Contract Expiry Date: n/a
Last Updated using manual update on Thu Oct 10 17:45:00 2024
Last Update Attempt: Tue Oct 22 06:48:32 2024
Result: Connectivity failure <--- make sure this is updated
Or :
Certificate Bundle
---------
Version: 1.00052
Contract Expiry Date: n/a
Last Updated using manual update on Thu Oct 17 14:54:47 2024
Last Update Attempt: Tue Oct 22 10:17:34 2024
Result: No Updates <----- Make sure this is updated.
If the certificate above mentioned is there in both the units in the cluster and if the certificate status shows 'Pass' with the above commands, would recommend rebooting the primary and secondary devices. Wait for a while and the issue will be fixed.
Related articles:
Technical Tip: Failed to contact FortiGuard servers due to unknown CA
Technical Tip: How to check most updated security version database on FortiGate
