Fortigate - how to renew a letsencrypt certificate

[TBC]

Hello @All,

we're using lets encrypt for our VPN access on Fortigate.

How can I renew that manual, or how is the process for automatically?

Fortigate OS is Version 7.2.0

Many thanks in advance

TBC

[Matt_B]

TBC,
I am assuming you are using ssl vpn with a manual letsencrypt certificate. If so the following advice applies.

You can follow the procedure in the admin guide to get a new letsencrypt certificate that autorenews with acme:
https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/822087/acme-certificate-supp...

Use the same FQDN that your existing certificate uses.

Be aware that this next step will reset existing connections: in your ssl vpn config, change certificate to use your new one.

That's it. If you have issues with the new certificate, you should be able to rollback to the old one by changing the config again- having two certificates that are both valid at the same time is allowed, but only one can be used in the ssl vpn.

[TBC]

Thank you Matt for fast response!

Unfortunately this does not work as desired, I get the following message:
This domain is already assigned to another ACME certificate: vpn.xxxx.net

How can I solve that?

many thanks

TBC

[Matt_B]

That sounds like you may already have a renewing certificate you can use. Verify that acme is using correct interface for renewal with cli:
get system acme status
You can review logs of acme activity with the following (produces a lot of text)
diagnose sys acme status-full vpn.xxxx.net

If you need more in-depth help, I would encourage you to open a ticket with fortinet support
https://support.fortinet.com/

[TBC]

Thank you, Matt

indeed at that moment I was generating a new cert, the old one was also renewed.
I tree before 3 or 4 times and the renewal are not working, not now everything is working!

Many thanks

TBC