Scenario:
Make: FortiGate, FortiNet
Model: FortiGate 400E, 100F, 60F, 240D Firewalls
Mode: Graphical User Interface [GUI]
Version: 7.4.3 or above
Description: In this article, we will discuss a stepwise method of how to resolve the issue of GUI or HTTP/HTTPS access of Secondary unit of HA Fortinet Firewall stop working after firmware upgrade to 7.4.3 or above.
Problem
Users have reported that after upgrading a Fortinet firewall to firmware 7.4.3 or later, the secondary unit of the HA cluster stops responding to GUI or HTTP/HTTPS access. The primary unit, however, remains accessible as usual after the upgrade.
Solution
To gain the HTTP/HTTPS or GUI access of the secondary unit of HA Fortinet firewalls again, follow the steps mentioned below
Step1: SSH onto Firewall
SSH onto the secondary unit of HA Fortinet firewall and login.
Step2: Check Crashlog
Check the crash log by executing the command as shown below.
edledge-fw # diag debug crashlog read
4: 2025-01-01 19:44:26 <00211> Node.JS restarted: (uncaught exception)
5: 2025-01-01 19:44:26 <00211> Error: error:05800074:x509 certificate routines::key values mismatch
Step3: Certificate Status
Run the CLI commands below to check whether the output shows the error “Certificate file and private key file are mismatched.”
edledge-fw # execute vpn certificate local verify Fortinet_GUI_Server
Certificate modulus: Modulus=DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDADA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B
9477C78644C463DDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477CB4E6173EAED37C0106593E9436B5B5D35D406D2EAB7189F0
6BADF243E6D4AE4B4A831B1C6C2EDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C789CA712AA90420DC38DA9B9B8A2259D9BD
ADDDD12CA7DBAE6505F9DDAB4B9477C81892E4A05A7C385CABD37C7A06B72D649D86DA850879AC2C3A20326DA9B9B8A2259D9BDADDDD12
CA7DBAE6505F9DDAB4B9477C5F128AD8B78B1B5B0E69479E2050A304D28B3CB28864B263D02A5C1E9B9B764F367F01D5342C817667414B
08E228FF9BC843266D1C22880718DB5693D4E2A2901443F518B0B577A7279A9B1E252DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477CF10DF26869077634F8447CB1383BB55F2670877269519C26BD0FE7E5AA115A48BC26FFBF05812B900E2E6FE5E6795B7B18A17066
F18196AC291E78E21C814918BF42675F7CCB35D64C11F010ACF9BB4F47F07DC9A6DD1DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477C4EEEB23A018AC7F4C07DF6CF1F0FD2F7BB8FE60B0514DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C29F9030D6FAA7
BEA5E9579AC9DCDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C13
File update time: <span style="font-family: courier new,courier;">2025-01-01 19:44:26
Private key modulus: Modulus=DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDADA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B
9477C78644C463DDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477CB4E6173EAED37C0106593E9436B5B5D35D406D2EAB7189F0
6BADF243E6D4AE4B4A831B1C6C2EDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C789CA712AA90420DC38DA9B9B8A2259D9BD
ADDDD12CA7DBAE6505F9DDAB4B9477C81892E4A05A7C385CABD37C7A06B72D649D86DA850879AC2C3A20326DA9B9B8A2259D9BDADDDD12
CA7DBAE6505F9DDAB4B9477C5F128AD8B78B1B5B0E69479E2050A304D28B3CB28864B263D02A5C1E9B9B764F367F01D5342C817667414B
08E228FF9BC843266D1C22880718DB5693D4E2A2901443F518B0B577A7279A9B1E252DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477CF10DF26869077634F8447CB1383BB55F2670877269519C26BD0FE7E5AA115A48BC26FFBF05812B900E2E6FE5E6795B7B18A17066
F18196AC291E78E21C814918BF42675F7CCB35D64C11F010ACF9BB4F47F07DC9A6DD1DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477C4EEEB23A018AC7F4C07DF6CF1F0FD2F7BB8FE60B0514DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C29F9030D6FAA7
BEA5E9579AC9DCDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C13
File update time: 2025-01-01 19:44:26
Certificate file and private key file are mismatched.
Step4: Default GUI Certificate
If you see this error, “Certificate file and private key file are mismatched” run the following command to install the default GUI certificate.
edledge-fw # execute vpn certificate local generate default-gui-mgmt-cert
Are you sure to re-generate the default GUI admin-server certificate?
Do you want to continue? (y/n)y
Certificate generation started, Please check it in a while.
edledge-fw
Step5: Verify Status
Check the certificate status again to confirm that the mismatch is resolved.
edledge-fw # execute vpn certificate local verify Fortinet_GUI_Server
If the same error still appears, wait a few minutes and check again. The mismatch error should clear, as shown below.
edledge-fw # execute vpn certificate local verify Fortinet_GUI_Server
Certificate modulus: Modulus=DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDADA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B
9477C78644C463DDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477CB4E6173EAED37C0106593E9436B5B5D35D406D2EAB7189F0
6BADF243E6D4AE4B4A831B1C6C2EDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C789CA712AA90420DC38DA9B9B8A2259D9BD
ADDDD12CA7DBAE6505F9DDAB4B9477C81892E4A05A7C385CABD37C7A06B72D649D86DA850879AC2C3A20326DA9B9B8A2259D9BDADDDD12
CA7DBAE6505F9DDAB4B9477C5F128AD8B78B1B5B0E69479E2050A304D28B3CB28864B263D02A5C1E9B9B764F367F01D5342C817667414B
08E228FF9BC843266D1C22880718DB5693D4E2A2901443F518B0B577A7279A9B1E252DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477CF10DF26869077634F8447CB1383BB55F2670877269519C26BD0FE7E5AA115A48BC26FFBF05812B900E2E6FE5E6795B7B18A17066
F18196AC291E78E21C814918BF42675F7CCB35D64C11F010ACF9BB4F47F07DC9A6DD1DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477C4EEEB23A018AC7F4C07DF6CF1F0FD2F7BB8FE60B0514DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C29F9030D6FAA7
BEA5E9579AC9DCDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C13
File update time: 2025-01-01 19:44:26
Private key modulus: Modulus=DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDADA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B
9477C78644C463DDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477CB4E6173EAED37C0106593E9436B5B5D35D406D2EAB8189F0
6BADF243E6D4AE4B4A831B1C7C2EDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C789CA712AA90420DC38DA9B9B8A2259D9BD
ADDDD12CA7DBAE6505F9DDAB4B9477C81892E4A05A7C385CABD38C7A06B72D649D86DA850879AC2C3A20326DA9B9B8A2259D9BDADDDD12
CA7DBAE6505F9DDAB4B9477C5F128AD8B78B1B5B0E69479E2050A304D28B3CB28864B263D02A5C1E9B9B764F367F01D5342C817667414B
08E228FF9BC843266D1C22880718DB5693D4E2A2901443F518B0B577A7279A9B1E252DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477CF10DF26869077634F8447CB1383BB55F2670877269519C26BD0FE7E5AA115A48BC26FFBF05812B900E2E6FE5E6795B7B18A17066
F18196AC291E78E21C814918BF42675F7CCB35D64C11F010ACF9BB4F47F07DC9A6DD1DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4
B9477C4EEEB23A018AC7F4C07DF6CF1F0FD2F7BB8FE60B0514DA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C29F9030D6FAA7
BEA5E9579AC9DCDA9B9B8A2259D9BDADDDD12CA7DBAE6505F9DDAB4B9477C13
File update time: 2025-01-01 19:44:26
Certificate file and private key file are matched.
Once you resolve the certificate mismatch, you can access the secondary firewall through the GUI or HTTPS.
Article ID: EA00174
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.