Technical Tip: Upload Certificate using PEM format

Description

The FortiGate GUI menu provides three certificate formats to import new certificates.

• Local Certificate: This requires a CER file. This option works if the certificate was generated from the FortiGate itself.

• PKCS12 or PKCS7: This format is encrypted and requires a 'password'.

• Certificate: Requires certificate file, key file and password.

 Another method is using 'PEM' format.

 A PEM certificate includes both 'Private Key' and the 'Certificate'.

Scope

FortiGate.

Solution

The method to import a certificate on PEM file is through CLI commands.

1 - PEM file not encrypted with a password.

Edit the 'PEM' file using any editor, such as Notepad. The file should look like this:

-----BEGIN RSA PRIVATE KEY-----

MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmE..............
......................................................................................
SPIXQuT8RMPDVNQ=
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIICVDCCAb2gAwIBAgIJANfHOBkZr8JOMA0GC...........
......................................................................................
CRlNBAAlvhKzO7Clpf9l0YKBEfraJByX
-----END RSA CERTIFICATE-----

Access FortiGate CLI through SSH or telnet and create a cert profile:

config vpn certificate local
    edit [name]

Set the command 'private-key', use single or double quotes to paste the certificate's private key (copy the 'RSA PRIVATE KEY' section, all from 'Begin' up to 'End'), then close the single or double quote and press 'Enter'.

set private-key "-----BEGIN RSA PRIVATE KEY-----
> MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBANtb0+YrKuxevGpm
.....................................................................................................................................
> SPIXQuT8RMPDVNQ=
> -----END RSA PRIVATE KEY-----"

Set the command 'certificate', use single or double quote to paste the certificate (copy the 'CERTIFICATE' section, all from 'Begin' up to 'End'), then close the single or double quote and press 'Enter'.

set certificate "-----BEGIN CERTIFICATE-----
> MIICVDCCAb2gAwIBAgIJANfHOBkZr8JOMA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNV
.....................................................................................................................................
> CRlNBAAlvhKzO7Clpf9l0YKBEfraJByX
> -----END CERTIFICATE-----"

Type 'end' to save the changes. If no messages are shown, it means that the certificate has been imported successfully. 

Example:

FGT # config vpn cert local
FGT (local) # edit ServerCert
FGT (ServerCert) # set private-key "-----BEGIN RSA PRIVATE KEY-----
> pkQTzalZ2tlbIsbWnhFS3hvyRYnj6Utm/nuFISMqnb70JALVKGRRBnVlE2HkS5Vy
...............................................................................
> +Q3oc4ygqRtHqv7HhekNeYGNXIt1XryvV1PMjIOCDvwHxNTYvThxc/2xIK9f2T5O
> -----END RSA PRIVATE KEY-----"
FGT (ServerCert) #
FGT (ServerCert) # set certificate "-----BEGIN CERTIFICATE-----
> MIIDvDCCAqSgAwIBAgIIfrg+CFpVYRIwDQYJKoZIhvcNAQELBQAwMTELMAkGA1UE
...............................................................................
> SbEmNiZ0W6s5T+3RkyqQiywTJBnu8R4RQGnXW3WORW0Pv89m03q8LqVjRjHy0zNN
> -----END CERTIFICATE-----"

Some error messages seen while uploading:

FGT (ServerCert) # set private-key "-----BEGIN RSA PRIVATE KEY-----
> pkQTzalZ2tlbIsbWnhFS3hvyRYnj6Utm/nuFISMqnb70JALVKGRRBnVlE2HkS5Vy
...............................................................................
> +Q3oc4ygqRtHqv7HhekNeYGNXIt1XryvV1PMjIOCDvwHxNTYvThxc/2xIK9f2T5O
> -----END RSA PRIVATE KEY-----"
Invalid private key, password may be required

 
In cases like this, the private key is encrypted, or the key is corrupted. Obtain a new key from the certificate authority and re-upload.

For the encrypted key, use the next method.

2 - PEM file encrypted with a password.

Edit the 'PEM' file using any editor such as Notepad. The file should look like this:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,29638804B34346D3A003D7C91A9EF48F
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmE..............
......................................................................................
SPIXQuT8RMPDVNQ=
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIICVDCCAb2gAwIBAgIJANfHOBkZr8JOMA0GC...........
......................................................................................
CRlNBAAlvhKzO7Clpf9l0YKBEfraJByX
-----END RSA CERTIFICATE-----

Access FortiGate CLI through SSH or telnet and create a cert profile:

config vpn certificate local
    edit [name]

Set the command 'password' to introduce the private-key decrypt password:

set password ThisIsAPassword

Set the command 'private-key'. Use single or double quote to paste the certificate's private key (copy the 'RSA PRIVATE KEY' section, all from 'Begin' up to 'End'), then close the single or double quotes and press 'Enter'.

set private-key "-----BEGIN RSA PRIVATE KEY-----
> Proc-Type: 4,ENCRYPTED
> DEK-Info: AES-256-CBC,29638804B34346D3A003D7C91A9EF48F
>

> MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBANtb0+YrKuxevGpm
.....................................................................................................................................
> SPIXQuT8RMPDVNQ=
> -----END RSA PRIVATE KEY-----"

Set the command 'certificate'. Use single or double quotes to paste the certificate (copy the 'CERTIFICATE' section, all from 'Begin' up to 'End'), then close the single or double quote and press 'Enter'.

set certificate "-----BEGIN CERTIFICATE-----
> MIICVDCCAb2gAwIBAgIJANfHOBkZr8JOMA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNV
.....................................................................................................................................
> CRlNBAAlvhKzO7Clpf9l0YKBEfraJByX
> -----END CERTIFICATE-----"

Type 'end' to save the changes. If no messages are shown, it means that the certificate has been imported successfully. 

Example:

FGT # config vpn cert local
FGT (local) # edit ServerCert
FGT (ServerCert) # set password ThisIsAPassword
FGT (ServerCert) # set private-key "-----BEGIN RSA PRIVATE KEY-----
> Proc-Type: 4,ENCRYPTED
> DEK-Info: AES-256-CBC,29638804B34346D3A003D7C91A9EF48F
>
> pkQTzalZ2tlbIsbWnhFS3hvyRYnj6Utm/nuFISMqnb70JALVKGRRBnVlE2HkS5Vy
...............................................................................
> +Q3oc4ygqRtHqv7HhekNeYGNXIt1XryvV1PMjIOCDvwHxNTYvThxc/2xIK9f2T5O
> -----END RSA PRIVATE KEY-----"
FGT (ServerCert) #
FGT (ServerCert) # set certificate "-----BEGIN CERTIFICATE-----
> MIIDvDCCAqSgAwIBAgIIfrg+CFpVYRIwDQYJKoZIhvcNAQELBQAwMTELMAkGA1UE
...............................................................................
> SbEmNiZ0W6s5T+3RkyqQiywTJBnu8R4RQGnXW3WORW0Pv89m03q8LqVjRjHy0zNN
> -----END CERTIFICATE-----"