Fortios 7.0.1 Let's Encrypt renewal error

[techevo]

Any body else having renewal error with acme certificate ?

diag sys acme status-full "xxxx.xxxxxx.ca"

{ "name": "xxxx.xxxxxx.ca", "finished": false, "notified": false, "next-run": "Thu, 05 Aug 2021 15:19:58 GMT", "last-run": "Thu, 05 Aug 2021 14:37:16 GMT", "errors": 554, "last": { "status": 22, "status-description": "Invalid argument", "problem": "urn:ietf:params:acme:error:malformed", "detail": "No order for ID xxxxxxxxxxxx" },

[Effenco_IT]

[align=left]Same error using v7.0.0 Build 0066GA. Any suggestion how to fix? Here our output: FWHOSTNAME # diagnose sys acme status-full xxxx.xxxxxxx.xxxx.com {   "name": "xxxxx.xxxx.xxxx.com",   "finished": true,   "notified": false,   "next-run": "Tue, 07 Sep 2021 17:28:46 GMT",   "last-run": "Tue, 07 Sep 2021 16:28:45 GMT",   "errors": 348,   "last": {     "status": 22,     "status-description": "Invalid argument",     "problem": "urn:ietf:params:acme:error:malformed",     "detail": "No order for ID ##########"   },   "log": {     "entries": [       {         "when": "Tue, 07 Sep 2021 16:28:46 GMT",         "type": "message-errored"       },       {         "when": "Tue, 07 Sep 2021 16:28:46 GMT",         "type": "renewal-error",         "status": "urn:ietf:params:acme:error:malformed",         "detail": "No order for ID ##########"       },       {         "when": "Tue, 07 Sep 2021 16:28:46 GMT",         "type": "progress",         "detail": "No order for ID ##########, problem: urn:ietf:params:acme:error:malformed"       },       {         "when": "Tue, 07 Sep 2021 16:28:45 GMT",         "type": "progress",         "detail": "Loaded order from staging"[/align]

[emnoc]

Is dns working? It sounds like the acme client might have issues. You can maybe trying to restart it and see what happens . FWIW I have no issues.

promete01:~ ken$ openssl s_client -connect 192.168.1.99:443 | openssl x509 -noout -datesdepth=3 O = Digital Signature Trust Co., CN = DST Root CA X3verify return:1depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1verify return:1depth=1 C = US, O = Let's Encrypt, CN = R3verify return:1depth=0 CN = blahblah.socpuppets.comverify return:1notBefore=Jul 26 09:58:12 2021 GMTnotAfter=Oct 24 09:58:10 2021 GMT  Ken Felix

[Effenco_IT]

Yes DNS is working fine in fact the error jumped just now the previous one renewal was successfully done.

[emnoc]

Just do the diag cmd if this happens again. I bet it might have some hidden issues of running the acme-client and protocol and DNS has be working. Are you using fortinet DNS or some other DNS servers?

Ken Felix

[Effenco_IT]

Hi Ken, thks again for answer, we use Windows Srv 2019 Std as DNS server. As mentioned before it was working fine  the second 100F that has almost same config just diff CN is working fine too, the renew on that one was successfully done last 18082021 in or second firewall.