CSCwk70545-Can't add FTD to FMC: Failed to issue certificate to device

[fahedhameed]

Hi, facing this issue when trying to add the same FTD agian in the FMC after deleting it.

Any help would be appreciated.

Thanks.

[Stefan Mihajlov]

@fahedhameed 

That error usually happens when the FTD still has the old CA/certificate record from the previous FMC registration. When you try to re-add it, FMC can’t issue a new cert because the device still presents the stale identity.

Fix is to clear the old registration info on the FTD and then re-register clean:

1. On the FTD CLI run:

configure manager delete

to wipe the FMC registration state.

2. If you use NAT, also re-apply the correct configure manager add <fmc_ip> <reg_key>.

3. Then go back to FMC and add the device again with the same key and management IP.

That forces the device to generate a new cert request and FMC will accept it. If it still fails, make sure the clock/timezone are in sync on both FMC and FTD, because mismatched time can also break certificate enrollment.

–––
Best regards,
Stefan Mihajlov

Mark this post as Helpful if it helped you, and Accept as Solution if it resolved your question.

[MHM Cisco World]

Delete or unregistered?

MHM