Error 'Validation Failed. Invalid Certificate.' when uploading a CA certificate

Description

This article describes how to remediate the issue of encountering error Validation Failed. Invalid Certificate when uploading a CA certificate.

Scope

FortiDeceptor v6.3 or below.

Solution

Navigate to System -> Certificates:

• Select Import.

• Give the Certificate Name a name.

• Select Choose File below Certificate.
  
  

To rectify this, open a ticket with TAC (Customer Service Tip: How to create a ticket for Fortinet TAC) and make a request for a v6.0 interim build0479 or wait for the v6.3.1 GA release.

Note: Ubuntu certificate validation example:

The following output is from a separate CA certificate (Team_Server_CA.crt) that was successfully imported in the lab. It is provided as a validation example and does not represent the certificate that triggered the error shown above.

1. Set the path to the certificate:
   
   

CERT="/path/to/Team_Server_CA.crt"

2. Check the file format, subject, issuer, validity period, and CA flag:
   
   

file "$CERT"

openssl x509 -in "$CERT" -noout -subject -issuer -dates

openssl x509 -in "$CERT" -noout -text | grep -A2 "Basic Constraints"

Example output:

/mnt/c/cert/kb/Team_Server_CA.crt: PEM certificate
subject=DC = lab, DC = local, CN = Local-Root-CA
issuer=DC = lab, DC = local, CN = Local-Root-CA
notBefore=Nov 15 11:29:25 2024 GMT
notAfter=Nov 15 11:39:19 2034 GMT
X509v3 Basic Constraints: critical
CA:TRUE

Confirm that the certificate is within its validity period and that Basic Constraints includes CA:TRUE.

3. For a DER format certificate, use:
   
   

openssl x509 -inform DER -in /path/to/ca-certificate.cer -noout -subject -issuer -dates

Note: Make sure to validate the certificate using OpenSSL or any other tool to make sure to trigger the mentioned issue above; then it is possible to request the interim build mentioned.