# Replace an expiring SSL certificate on a FortiGate (VPN and admin GUI) The CA renewed the certificate, but the FortiGate keeps serving the old one until you import the new file and select it for each service. This runbook covers FortiOS 7.4 and 7.6. ## First: what your FortiOS version still has VPN features changed a lot across recent releases, so check yours before following any older instructions: - **FortiOS 7.6.3 and later:** SSL VPN **tunnel mode is removed** and replaced by IPsec VPN (which can run over TCP 443). Web mode is renamed **Agentless VPN**; its CLI is still `config vpn ssl settings`. - **FortiOS 7.6.0 and later:** SSL VPN is removed entirely from models with 2 GB of RAM or less (40F, 60F, 61F and others). - **G-series entry models** (50G, 70G, 90G): no SSL VPN on 7.4 either. - **Other models on 7.4:** SSL VPN, including tunnel mode, still exists. ## 1. Import the certificate GUI: **System > Certificates > Create/Import > Certificate > Import Certificate**, then pick the type: - **PKCS #12:** the `.pfx`/`.p12` file and its password (most common). - **Certificate:** a certificate file plus a separate key file and password. - **Local Certificate:** only when the CSR was generated on this FortiGate. Then import the **intermediate** certificate: **System > Certificates > Create/Import > CA Certificate**, type **File**. CLI alternative for a PKCS #12 file on a TFTP server: ``` execute vpn certificate local import tftp p12 ``` With VDOMs enabled, certificates are managed in the global context. ## 2. Assign it to each service **Admin GUI:** **System > Settings > Administration Settings > HTTPS server certificate**, then Apply. You will be logged out. CLI: ``` config system global set admin-server-cert "" end ``` **VPN portal:** on 7.6.3 and later, **VPN > Agentless VPN Settings > Server Certificate**; on 7.4, **VPN > SSL-VPN Settings > Server Certificate**. CLI (both): ``` config vpn ssl settings set servercert "" end ``` **Protecting an internal server with SSL inspection:** in the SSL/SSH inspection profile, set `server-cert-mode replace` and `server-cert` to the new certificate. ## 3. Check it from outside ``` openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts `. ## Common problems - **"Certificate is currently being used" when deleting the old one:** it is still referenced, usually as `admin-server-cert`. Point every service to the new certificate first, then search the configuration for the old name. - **"Certificate file is duplicated":** the bundle contains a CA that is already installed. Import only the server certificate and key. - **Android FortiClient shows an untrusted warning** although the certificate is valid: the full chain isn't being sent. Import the intermediate. - **The FQDN must be in the certificate's SAN,** not only in its common name. ## Let the FortiGate renew it: ACME FortiOS can get and renew Let's Encrypt certificates itself, which suits shorter certificate lifetimes (200 days from March 2026, falling to 47 days by 2029). GUI: **System > Certificates > Create/Import > Certificate > Use Let's Encrypt**. Enter the public FQDN and an email address, then choose the interface for ACME. CLI: ``` config system acme set interface "" end config vpn certificate local edit "" set enroll-protocol acme2 set acme-domain "vpn.example.com" set acme-email "it@example.com" next end ``` Requirements and limits: - The FQDN resolves publicly to the ACME interface; one name per certificate, no wildcards. - Validation uses TLS-ALPN-01 on TCP 443, falling back to HTTP-01 on TCP 80. It fails if something else holds those ports, such as a VIP, admin HTTPS redirect, or IKE on TCP 443 (the default IKE TCP port from 7.6.1). - Renewal is automatic, 30 days before expiry by default (`acme-renew-window`). - Check progress with `diagnose sys acme status-full `. Once the ACME certificate exists, assign it to the services as in step 2. ## Check your domain The free scan finds every certificate issued for your domain in the CT logs and flags hosts, like a FortiGate VPN portal, that still serve an older one after a renewal. See also [Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed). ## Sources - [Fortinet: import a certificate (7.4)](https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/907098/import-a-certificate) - [Fortinet: procuring and importing a signed SSL certificate (7.6.3)](https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/825073/procuring-and-importing-a-signed-ssl-certificate) - [Fortinet: SSL VPN tunnel mode no longer supported (7.6.3)](https://docs.fortinet.com/document/fortigate/7.6.3/fortios-release-notes/173430/ssl-vpn-tunnel-mode-no-longer-supported) - [Fortinet: SSL VPN removed from 2 GB RAM models (7.6.0)](https://docs.fortinet.com/document/fortigate/7.6.0/fortios-release-notes/877104/ssl-vpn-removed-from-2gb-ram-models-for-tunnel-and-web-mode) - [Fortinet: automatically provision a certificate (ACME)](https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/822087/automatically-provision-a-certificate) - [Fortinet CLI reference: config vpn certificate local](https://docs.fortinet.com/document/fortigate/7.6.3/cli-reference/556354036/config-vpn-certificate-local) - [Fortinet community: when the full chain isn't sent](https://community.fortinet.com/fortigate-3/technical-tip-how-to-verify-and-resolve-issues-when-fortigate-does-not-send-the-full-certificate-chain-for-web-gui-or-ssl-vpn-183655) - [Fortinet community: common causes of ACME renewal failure](https://community.fortinet.com/fortigate-3/troubleshooting-tip-common-causes-for-let-s-encrypt-acme-certificate-renewal-failure-129200) --- Source: https://nameward.app/guides/fortigate-replace-ssl-certificate (updated 2026-10-29)