Technical Tip: How to register a new cluster when FortiManager 7.2.5 complains about subject CN or SAN in peer's certificate error

[sfrati]

Description	This article explains how to solve the error message 'serial number (FGTxxxxx) in 'get' message doesn't match the subject CN (FGTyyyyyy) or SAN in peer's certificate, exit.' when trying to register a new FortiGate cluster to FortiManager 7.2.5.
Scope	Using FortiManager 7.2.5: When FortiGate registers to FortiManager for the first time or when the fgfmd daemon later connects to FortiManager on TCP/541 when configured as a central-management, the primary node of the cluster establishing the connection with the FortiManager uses an encrypted TLS connection. This connection is authenticated using a built-in Fortinet_Factory certificate stored on the device and based on the serial number of the device as CN. When a cluster of two or more nodes is created, the certificate is replicated from the master to slaves. Note: it is possible to display on each node the CN of the embedded factory certificate: FortiJak (root) # config vpn certificate local FortiJak (local) # get Fortinet_Factory | grep CN         Subject:     C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = FortiGate, CN = FG101FTK1xxxxx29, emailAddress = support@fortinet.com         Issuer:      C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = Certificate Authority, CN = fortinet-subca2001, emailAddress = support@fortinet.com And compare it to the serial number stored in BIOS, on each node: here the serial number of the primary node is displayed and equal to the CN content of the cluster's certificate: FortiJak (root)# get sys status | grep -i serial Serial-Number: FG101FTK1xxxxx29 When a cluster is established, the Fortinet_Factory or the certificate used to communicate with the FortiManager is replicated on all members of the cluster. Then it can lead to a situation where the BIOS Serial Number is not the same as the certificate CN presented to the FortiMager for registration connection.
Solution	Enable fgfm-peercert-withoutsn in the config system global. FortiManager 7.2.5 introduces a new by default verification of the CN or SAN (see Special Notices) to enforce additional security levels and avoid MITM issues when a new device tries to establish a new connection or registration. By default, this verification is enabled and checks if the subject is CN or SAN of the FortiGate. If, by any chance, the node trying to register to the FortiManager is not the primary node that generated the certificate for the cluster, the connection or registration will not be allowed. It is possible to disable this new feature and return to the previous 7.2.4 behavior using this CLI and allow registration from any node of the cluster: config system global     set fgfm-peercert-withoutsn enable end With this option enabled, FortiManager will not proceed to the additional checking if the Serial Number of the requesting device and the one displayed in the certificate exactly match.