Lets Encrypt cerficiates aren't created properly

[andrejwknd]

Hi,

I'm having issues generating Let's Encrypt certificates on our FortiGate. We have a connection to Let's Encrypts ACME server, DNS was also checked. Our subdomain resolves to the correct IP address. FortiGate also says that the renewal was successful, however the certificate cannot be used in any service (we are generating a cert for SSL-VPN). When you try to view the details of the cert this is what you get:

get vpn certificate local details SSLVPN 

== [ SSLVPN ] ACME details: Status: Unprovisioned 
Staging status: The certificate for the managed domain has been renewed successfully and can be used (valid since Mon, 08 Sep 2025 12:32:13 GMT). A graceful server restart now is recommended.

We also tried restarting Fortigate, no luck.

How can we troubleshoot this ?

Thank you in advance!

[andrejwknd]

Already tried this multiple times. Did not help.

[adamsmith12]

It looks like the FortiGate is successfully reaching Let’s Encrypt and completing the ACME challenge, but the certificate isn’t being properly applied to services like SSL-VPN. This can sometimes happen if the certificate isn’t set as the default for the VPN interface, or if FortiGate generates a “dummy” cert when the key binding fails. I’d recommend checking whether the certificate is fully imported into Local Certificates with a private key and then reassigning it to the SSL-VPN settings. https://community.fortinet.com/t5/Support-Forum/Lets-Encrypt-Learn more-cerficiates-aren-t-created-properly/td-p/410158

[andrejwknd]

Hi Adam! I tried opening the link you sent me however it seems that it is not working. Could you maybe resend me the link.

[carlbidwell]

I had the same issue before, in my case it turned out to be a DNS problem. Double-check your FortiGate’s DNS settings and make sure outbound HTTP/HTTPS is allowed, that fixed it for me.

[andrejwknd]

Hi! Thank you for the response. I tried using the default FortiGate DNS servers, and ofcourse the standard Google/Cloudflare servers. Seems that DNS is working. How would i check outbound HTTP/HTTPS ?