Renew SSL certificate on FortiGate (VPN and admin GUI)

The CA renewed the certificate, but the FortiGate keeps serving the old one until you import the new file and select it for each service. This runbook covers FortiOS 7.4 and 7.6.

First: what your FortiOS version still has

VPN features changed a lot across recent releases, so check yours before following any older instructions:

FortiOS 7.6.3 and later: SSL VPN tunnel mode is removed and replaced by IPsec VPN (which can run over TCP 443). Web mode is renamed Agentless VPN; its CLI is still config vpn ssl settings.
FortiOS 7.6.0 and later: SSL VPN is removed entirely from models with 2 GB of RAM or less (40F, 60F, 61F and others).
G-series entry models (50G, 70G, 90G): no SSL VPN on 7.4 either.
Other models on 7.4: SSL VPN, including tunnel mode, still exists.

1. Import the certificate

GUI: System > Certificates > Create/Import > Certificate > Import Certificate, then pick the type:

PKCS #12: the .pfx/.p12 file and its password (most common).
Certificate: a certificate file plus a separate key file and password.
Local Certificate: only when the CSR was generated on this FortiGate.

Then import the intermediate certificate: System > Certificates > Create/Import > CA Certificate, type File.

CLI alternative for a PKCS #12 file on a TFTP server:

execute vpn certificate local import tftp <file.pfx> <tftp-server-ip> p12 <password>

With VDOMs enabled, certificates are managed in the global context.

2. Assign it to each service

Admin GUI: System > Settings > Administration Settings > HTTPS server certificate, then Apply. You will be logged out. CLI:

config system global
    set admin-server-cert "<certificate-name>"
end

VPN portal: on 7.6.3 and later, VPN > Agentless VPN Settings > Server Certificate; on 7.4, VPN > SSL-VPN Settings > Server Certificate. CLI (both):

config vpn ssl settings
    set servercert "<certificate-name>"
end

Protecting an internal server with SSL inspection: in the SSL/SSH inspection profile, set server-cert-mode replace and server-cert to the new certificate.

3. Check it from outside

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null

Check the expiry date. If the output shows only depth 0, the intermediate is missing: import it as a CA certificate. The VPN daemon doesn't reload CA certificates on its own; fnsysctl killall sslvpnd restarts it but disconnects VPN users, so do it out of hours.

On the FortiGate: get vpn certificate local details <certificate-name>.

Common problems

"Certificate is currently being used" when deleting the old one: it is still referenced, usually as admin-server-cert. Point every service to the new certificate first, then search the configuration for the old name.
"Certificate file is duplicated": the bundle contains a CA that is already installed. Import only the server certificate and key.
Android FortiClient shows an untrusted warning although the certificate is valid: the full chain isn't being sent. Import the intermediate.
The FQDN must be in the certificate's SAN, not only in its common name.

Let the FortiGate renew it: ACME

FortiOS can get and renew Let's Encrypt certificates itself, which suits shorter certificate lifetimes (200 days from March 2026, falling to 47 days by 2029).

GUI: System > Certificates > Create/Import > Certificate > Use Let's Encrypt. Enter the public FQDN and an email address, then choose the interface for ACME. CLI:

config system acme
    set interface "<wan-interface>"
end
config vpn certificate local
    edit "<certificate-name>"
        set enroll-protocol acme2
        set acme-domain "vpn.example.com"
        set acme-email "[email protected]"
    next
end

Requirements and limits:

The FQDN resolves publicly to the ACME interface; one name per certificate, no wildcards.
Validation uses TLS-ALPN-01 on TCP 443, falling back to HTTP-01 on TCP 80. It fails if something else holds those ports, such as a VIP, admin HTTPS redirect, or IKE on TCP 443 (the default IKE TCP port from 7.6.1).
Renewal is automatic, 30 days before expiry by default (acme-renew-window).
Check progress with diagnose sys acme status-full <domain>.

Once the ACME certificate exists, assign it to the services as in step 2.

Check your domain

The free scan finds every certificate issued for your domain in the CT logs and flags hosts, like a FortiGate VPN portal, that still serve an older one after a renewal. See also Certificate renewed but not installed.

Replace an expiring SSL certificate on a FortiGate (VPN and admin GUI)