Technical Tip: How to register a new cluster when FortiManager v7.0.12 or v7.2.5 complains about subject CN or SAN in peer's certificate error resulting in a down status cluster

[sfrati]

Description	This article explains how to solve the error message 'serial number (FGTxxxxx) in 'get' message doesn't match the subject CN (FGTyyyyyy) or SAN in peer's certificate, exit.' when trying to register a new FortiGate cluster to FortiManager v7.0.12 or v7.2.5.
Scope	Using FortiManager v7.0.12, v7.2.5 or v7.4.5: When FortiGate registers to FortiManager for the first time or when the fgfmd daemon later connects to FortiManager on TCP/541 when configured as a central-management, the primary node of the cluster establishing the connection with the FortiManager uses an encrypted TLS connection. This connection is authenticated using a built-in Fortinet_Factory certificate stored on the device and based on the serial number of the device as CN. When a cluster of two or more nodes is created, the certificate is replicated from the master to the slaves. Note: It is possible to display on each node the CN of the embedded factory certificate: FortiJak (root) # config vpn certificate local FortiJak (local) # get Fortinet_Factory | grep CN         Subject:     C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = FortiGate, CN = FG101FTK1xxxxx29, emailAddress = support@fortinet.com         Issuer:      C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = Certificate Authority, CN = fortinet-subca2001, emailAddress = support@fortinet.com And compare it to the serial number stored in BIOS, on each node: here the serial number of the primary node is displayed and equal to the CN content of the cluster's certificate: FortiJak (root)# get sys status | grep -i serial Serial-Number: FG101FTK1xxxxx29 When a cluster is established, the Fortinet_Factory or the certificate used to communicate with the FortiManager is replicated on all members of the cluster. Then it can lead to a situation where the BIOS Serial Number is not the same as the certificate CN presented to the FortiMager for registration connection.
Solution	Enable fgfm-peercert-withoutsn in the config system global. FortiManager v7.0.12 or v7.2.5 introduces a new by default verification of the CN or SAN (see Special Notices) to enforce additional security levels and avoid MITM issues when a new device tries to establish a new connection or registration. By default, this verification is enabled and checks if the subject is CN or SAN of the FortiGate. If, by any chance, the node trying to register to the FortiManager is not the primary node that generated the certificate for the cluster, the connection or registration will not be allowed. It is possible to disable this new feature and return to the previous 7.0.11 or 7.2.4 behavior using this CLI and allow registration from any node of the cluster: Disabled on v7.2.10/v7.4.5/v7.6.1 onward: config system global     set fgfm-peercert-withoutsn enable. --> It has been disabled starting from v7.4.6 and onwards. end Note: The command above is deprecated starting from FortiOS v.7.4.6. With this option enabled, FortiManager will not proceed to the additional checking if the Serial Number of the requesting device and the one displayed in the certificate exactly match. If the FortiManager is running after v7.0.12 or v7.2.5, the Connection Status is down (Not Managed): Verify that in FortiGate, the central management configuration should be similar: config system central-management     set type fortimanager     set fmg "X.X.X.X" <----- Where, X.X.X.X is the FortiManager IP address.     set fmg-source-ip Y.Y.Y.Y <----- Y.Y.Y.Y is the FortiManager source IP address.         config server-list             edit 1                 set server-type update rating Then run the debugs and sniffer, as explained in the following article: Troubleshooting Tip: How to troubleshoot connectivity issues between FortiGate and FortiManager. In debugs, if encountering the following error, or in PCAP, if FortiManager is sending reset: 2024-08-30 09:39:38 FGFMs: Remote issuer is /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com. 2024-08-30 09:39:38 FGFMs: issuer matching...try next if not match... localissuer(fortinet-subca2001), remoteissuer(support) 2024-08-30 09:39:38 FGFMs: need change local cert to ISSUER[support] The issue relates to the FortiGate local certificate name Fortinet_Factory Subject Common Name (CN) using 'fortigate'. Ensure the Fortinet_Factory Subject Common Name (CN) uses FortiGate Serial Number rather than 'fortigate'. Solution: Run the below command to confirm the device serial number: dia deb vm-print-license SerialNumber: FGVMXXXXXXXX <----- Check this serial number. CreateDate: Thu Nov 2 16:16:23 2024 Key: yes Cert: yes Key2: yes Cert2: yes Model: 04 (9) CPU: 4 MEM: 2147483647 VDOM license: permanent: 10 subscription: 0   Once the serial number is confirmed, run the following command: exec vm-license FGVMXXXXXXXX <----- Replace this with the serial number retrieved from the above command. This operation will reboot the system ! Do you want to continue? (y/n)y Note: Running the above command will reboot and will re-apply the license. To set up the certificate: Technical Tip: Setup custom certificate for FGFM protocol To adjust the FortiGate Certificate Serial Number: Troubleshooting Tip: 'Issue sending initial FortiGate Serial Number' error when connecting to EMS Cl...  How to resolve a connectivity issue between an Azure or AWS FortiGate and FortiManager or EMS: Troubleshooting Tip: Resolving a connectivity issue between an Azure or AWS FortiGate and an EMS and...