License has not been validated by FortiGuard Issue

[52000cc]

I'm not sure why my license suddenly shows as not being validated, with the error shown below. Could you please let me know what caused this and how to resolve it?

upd_fds_load_default_server6[1046]-Resolve and add fds update.fortiguard.net ipv6 address failed.
upd_comm_connect_fds[457]-Trying FDS 208.184.237.66:443
[116] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default)
[116] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory_Backup.cer, root ca Fortinet_CA_Backup, idx 1
[497] ssl_ctx_use_builtin_store: Loaded Fortinet Trusted Certs
[517] ssl_ctx_use_builtin_store: Enable CRL checking.
[524] ssl_ctx_use_builtin_store: Enable OCSP Stapling.
[835] ssl_ctx_create_new: SSL CTX is created
[862] ssl_new: SSL object is created
[212] ssl_add_ftgd_hostname_check: Add hostname checking 'update.fortiguard.net'...
[929] ssl_set_hostname: Set hostname 'fortinet-ca2.fortinet.com'
[720] __ssl_info_callback: before SSL initialization
[720] __ssl_info_callback: SSLv3/TLS write client hello
[720] __ssl_info_callback: SSLv3/TLS write client hello
[720] __ssl_info_callback: SSLv3/TLS read server hello
[720] __ssl_info_callback: TLSv1.3 read encrypted extensions
[720] __ssl_info_callback: SSLv3/TLS read server certificate request
[362] __ssl_crl_verify_cb: Cert error 19, self-signed certificate in certificate chain. Depth 2
__upd_peer_vfy[329]-Server certificate failed verification. Error: 19 (self-signed certificate in certificate chain), depth: 2, subject: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=fortinet-ca2/emailAddress=support@fortinet.com.
[1070] ssl_connect: SSL_connect failes: error:0A000086:SSL routines::certificate verify failed
ssl_connect_fds[391]-Failed SSL connecting (5,0,Success)
[207] __ssl_data_ctx_free: Done
[1115] ssl_free: Done
[199] __ssl_cert_ctx_free: Done
[1125] ssl_ctx_free: Done
upd_comm_connect_fds[476]-Failed SSL connect

[52000cc]

The FortiGuard debug shows normal now, and the SSL errors in the log have also been resolved.

Why is it necessary to enable FortiGuard-anycast? I had it disabled before, and everything was working fine. Could there be any other impacts?

[kaman]

Hi 52000cc,

It’s nice to hear that the issue has been resolved.

Please be notified that if verifying that there is no upstream unit or any device that is doing the inspection and still experiencing the issue. This might be happening because the certificate bundle is missing some Public certificates.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Failed-to-contact-FortiGuard-servers-due-t...

Bydefault, fortiguard-anycast is enabled to optimize the routing performance to FortiGuard servers.
Relying on Fortinet DNS servers, the FortiGate will get a single IP address for the domain name of each FortiGuard service. BGP routing optimization is transparent to the FortiGate.

Note: HTTPS/443 is only supported on anycast servers.

Please refer to the below documents for more information:

https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/734277/fortiguard-third-party-ssl-valid....

https://docs.fortinet.com/document/fortigate/6.4.0/new-features/925541/use-anycast-to-communicate-wi...

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman