Can't push policy from FMG to FGT. Certificate Errors

[vk123]

Hello everyone,

I'm trying to create a small VM lab based on a FMG and a few FGT. I did set up every VM correctly but I'm facing an issue whenever I add a Fortigate to the FortiManager and try to push a new policy package to the FGT. Looks like it's a problem about certificates.

Install History:

HUB-1 80% 2020-07-02 05:12:34:fgfm install state: prepare to post-checksum HUB-1 90% 2020-07-02 05:12:40:post-checksum state: start verification HUB-1 95% 2020-07-02 05:12:44:verify state: install OK/verify FAIL

Install Logs:

Starting log (Run on device) Start installing FortiGate-VM $ config vpn certificate ca FortiGate-VM (ca) $ edit "root_CA2" FortiGate-VM (root_CA2) $ set ca "-----BEGIN CERTIFICATE----- FortiGate-VM (root_CA2) $ MIIDADCCAeigAwIBAgIgRTk2MjE0OTk5NDk3QkM3NUREQTQyRURBMTg4NEExQ0Qw  ... FortiGate-VM (root_CA2) $ iXJK2fIdzPWUqEHExeVawvcCZBxzpw7dwB5fdKCyZ6Zj+FVVY+Q+TrPNyIfiirRc FortiGate-VM (root_CA2) $ vi5lVQ== FortiGate-VM (root_CA2) $ -----END CERTIFICATE-----" Input is not a valid CA certificate. FortiGate-VM (root_CA2) $ set range global FortiGate-VM (root_CA2) $ next The field ca is empty! node_check_object fail! for ca Attribute 'ca' MUST be set. Command fail. Return code 1 FortiGate-VM (ca) $ end ---> generating verification report  ( vpn certificate ca )  add entry "root_CA2" (vdom root: vpn certificate ca "root_CA2":ca)  remote original:  to be installed: "-----BEGIN CERTIFICATE----- MIIDADCCAeigAwIBAgIgRTk2MjE0OTk5NDk3QkM3NUREQTQyRURBMTg4NEExQ0Qw ... vi5lVQ== -----END CERTIFICATE-----" (vdom root: vpn certificate ca "root_CA2":range)  remote original:  to be installed: global ------- Start to retry -------- FortiGate-VM $ config vpn certificate ca FortiGate-VM (ca) $ edit "root_CA2" FortiGate-VM (root_CA2) $ set ca "-----BEGIN CERTIFICATE----- FortiGate-VM (root_CA2) $ MIIDADCCAeigAwIBAgIgRTk2MjE0OTk5NDk3QkM3NUREQTQyRURBMTg4NEExQ0Qw ... FortiGate-VM (root_CA2) $ vi5lVQ== FortiGate-VM (root_CA2) $ -----END CERTIFICATE-----" Input is not a valid CA certificate. FortiGate-VM (root_CA2) $ set range global FortiGate-VM (root_CA2) $ next The field ca is empty! node_check_object fail! for ca Attribute 'ca' MUST be set. Command fail. Return code 1 FortiGate-VM (ca) $ end ---> generating verification report  ( vpn certificate ca )  add entry "root_CA2" (vdom root: vpn certificate ca "root_CA2":ca)  remote original:  to be installed: "-----BEGIN CERTIFICATE----- MIIDADCCAeigAwIBAgIgRTk2MjE0OTk5NDk3QkM3NUREQTQyRURBMTg4NEExQ0Qw ... vi5lVQ== -----END CERTIFICATE-----" (vdom root: vpn certificate ca "root_CA2":range)  remote original:  to be installed: global install failed

I know other people have faced the same issues but still no fix for this. Any idea ?

Help is welcome.

Thanks a lot!

[ceForti]

There are two options to fix this;

1

login to Fortimanager

Policy and Objects (Tools - Display Options - Advanced),

Object Configurations > CLI Only Objects.
Expand vpn, expand certificate, select ca.
Select and Delete the certificate that is causing the issue.

2.

If required, you can remove the certificate from each device’s configuration.
Device Manager screen,

CLI Configurations.
Expand: vpn, certificate, ca.
Select and Delete the certificate that is causing the issue.

More details here - https://www.clintmcguire.com/blog/fortimanager-vpn-certificate/

[praveshr]

Getting same issue on FMG 7.6, and not getting the suggested option.