ACME Challenge Replication in Clustered Deployments (8.0.0)

FortiWeb 8.0.0 enhances ACME protocol support in cluster-based deployments (AAH and Manager modes) by introducing automatic challenge replication for HTTP-01 and TLS-ALPN-01 validation methods.

In previous versions, ACME challenge handling was limited to the node that initiated the certificate request. However, in clustered environments, DNS records often resolve to multiple FortiWeb IP addresses across different nodes. This created unpredictability in the ACME validation process: if the ACME server resolved to an IP associated with a secondary node that was not serving the challenge, certificate issuance could fail.

To address this, FortiWeb now replicates ACME challenge information across all nodes in the cluster. This ensures that:

• All nodes respond correctly to HTTP-01 challenges received over HTTP.

• All nodes support TLS-ALPN-01 challenges during SSL/TLS handshakes using the ALPN extension.

By distributing the challenge responses, FortiWeb eliminates the risk of validation failure due to DNS load balancing or round-robin resolution in clustered topologies.