Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
techevo
New Contributor

Fortios 7.0.1 Let's Encrypt renewal error

Any body else having renewal error with acme certificate ?

 

diag sys acme status-full "xxxx.xxxxxx.ca"

{ "name": "xxxx.xxxxxx.ca", "finished": false, "notified": false, "next-run": "Thu, 05 Aug 2021 15:19:58 GMT", "last-run": "Thu, 05 Aug 2021 14:37:16 GMT", "errors": 554, "last": { "status": 22, "status-description": "Invalid argument", "problem": "urn:ietf:params:acme:error:malformed", "detail": "No order for ID xxxxxxxxxxxx" },

 

 

5 REPLIES 5
Effenco_IT
New Contributor

[align=left]Same error using v7.0.0 Build 0066GA. Any suggestion how to fix? Here our output: FWHOSTNAME # diagnose sys acme status-full xxxx.xxxxxxx.xxxx.com {   "name": "xxxxx.xxxx.xxxx.com",   "finished": true,   "notified": false,   "next-run": "Tue, 07 Sep 2021 17:28:46 GMT",   "last-run": "Tue, 07 Sep 2021 16:28:45 GMT",   "errors": 348,   "last": {     "status": 22,     "status-description": "Invalid argument",     "problem": "urn:ietf:params:acme:error:malformed",     "detail": "No order for ID ##########"   },   "log": {     "entries": [       {         "when": "Tue, 07 Sep 2021 16:28:46 GMT",         "type": "message-errored"       },       {         "when": "Tue, 07 Sep 2021 16:28:46 GMT",         "type": "renewal-error",         "status": "urn:ietf:params:acme:error:malformed",         "detail": "No order for ID ##########"       },       {         "when": "Tue, 07 Sep 2021 16:28:46 GMT",         "type": "progress",         "detail": "No order for ID ##########, problem: urn:ietf:params:acme:error:malformed"       },       {         "when": "Tue, 07 Sep 2021 16:28:45 GMT",         "type": "progress",         "detail": "Loaded order from staging"[/align]
emnoc
Esteemed Contributor III

Is dns working? It sounds like the acme client might have issues. You can maybe trying to restart it and see what happens . FWIW I have no issues.

 

promete01:~ ken$ openssl s_client -connect 192.168.1.99:443 | openssl x509 -noout -dates

depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3

verify return:1

depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1

verify return:1

depth=1 C = US, O = Let's Encrypt, CN = R3

verify return:1

depth=0 CN = blahblah.socpuppets.com

verify return:1

notBefore=Jul 26 09:58:12 2021 GMT

notAfter=Oct 24 09:58:10 2021 GMT

 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Effenco_IT

Yes DNS is working fine in fact the error jumped just now the previous one renewal was successfully done.

emnoc
Esteemed Contributor III

Just do the diag cmd if this happens again. I bet it might have some hidden issues of running the acme-client and protocol and DNS has be working. Are you using fortinet DNS or some other DNS servers?

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Effenco_IT

Hi Ken, thks again for answer, we use Windows Srv 2019 Std as DNS server. As mentioned before it was working fine  the second 100F that has almost same config just diff CN is working fine too, the renew on that one was successfully done last 18082021 in or second firewall.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors