Troubleshooting Tip: Secondary Certificates lost after upgrade from v F7.6.3 or v F7.6.4

[cmaheu]

Description	This article describes the behavior where upgrading in a High Availability configuration removes the Secondary Server certificates. The certificates are no longer listed under System -> Certificate Management for the Secondary.   The behavior occurs if all the following conditions apply: FortiNAC is running version F 7.6.3 or F 7.6.4 before the upgrade. Separate certificates are used for the primary and secondary servers. Certificates are installed using a custom alias (Example: New EAP target).
Scope	FortiNAC v F7.6.3, v F7.6.4.
Solution	Fixed in version F7.6.5. However, if already running either version F7.6.3 or F7.6.4, then one of the following workarounds must be performed to recover the certificates for the Secondary Server post upgrade. Workaround Option 1: Post upgrade, install new certificates to the Alias for the Secondary. Workaround Option 2: Copy the existing Secondary certificate to a temporary alias and re-copy to the original alias post upgrade. Option 2 Procedure: Example values: Alias for Secondary Server certificate to be preserved: LOCAL. Primary Hostname: fnac01.nacqa.test. Secondary Hostname: fnac02.nacqa.test. Before the upgrade, create a temporary alias on the primary. Go to System -> Certificate Management. Select Generate CSR. Configure using the table below. Select OK. When the Result window appears, select Close. There is no need to restart the service. Applied to Primary Certificate Target New Local RADIUS Server Target (EAP) New Target Alias TEMP Use Result as Self-Signed Certificate Enabled Common Name Primary Server hostname Copy the Secondary certificates to be preserved to the temporary alias. Highlight the Secondary server certificate alias and select Copy Certificate. Copy the secondary certificate to the TEMP alias. Use the table below. Select OK. When the Result window appears, select Close. There is no need to restart the service. Copy Source Alias for Secondary server certificate Source Applied To Secondary Copy Target Local RADIUS Server (EAP) [TEMP] Destination Applied To Primary   Upgrade FortiNAC. After the upgrade, create a new alias with the same name as the original alias for the secondary. Go to System -> Certificate Management. Select Generate CSR. Configure using the table below. Select OK. When the Result window appears, select Close. There is no need to restart the service. Applied to Secondary Certificate Target New Local RADIUS Server Target (EAP) New Target Alias Alias for Secondary server certificate Use Result as Self-Signed Certificate Enabled Common Name Secondary Server hostname   Copy the certificate from the TEMP alias to the original Alias for Secondary. Go to System -> Certificate Management. Highlight the TEMP alias and select Copy Certificate. Configure using the table below. Select OK. When the Result window appears, select Close. There is no need to restart the service. Copy Source Local RADIUS Server (EAP) [TEMP] Source Applied To Primary Copy Target Local RADIUS Server (EAP) [< Alias for Secondary server certificate >] Destination Applied To Secondary The procedure is complete. TEMP alias can be deleted, if desired.