Technical Tip: How to Convert a PKCS#12 Certificate to Legacy Format for FortiManager/FortiAnalyzer

When importing a local certificate under System Settings -> Certificates does not work because the certificate was created with a newer OpenSSL version that FortiManager/FortiAnalyzer does not yet support.

Importing certificate Error will be something like 'Importing local certificate failed. It might already exist'.

Here is a step-by-step procedure on a Linux PC using Linux commands to convert and export the certificate so it can be successfully uploaded to FortiManager/FortiAnalyzer.

ubuntu@ubuntu1910:~/Documents$ mkdir legacy_folder

ubuntu@buntu1910:~/Documents$ openssl pkcs12 -in <CERTIFICATE_NAME>.pfx -out legacy_folder/key.pem -nocerts -nodes -legacy
Enter Import Password:

ubuntu@ubuntu1910:~/Documents$ openssl pkcs12 -in <CERTIFICATE_NAME>.pfx -out legacy_folder/cert.pem -nokeys -nodes -legacy
Enter Import Password: xxxxxx

ubuntu@ubuntu1910:~/Documents$ openssl rsa -in legacy_folder/key.pem -out key_legacy_new.pem
writing RSA key

ubuntu@ubuntu1910:~/Documents$ openssl pkcs12 -export -out legacy_version.pfx -inkey key_legacy_new.pem -in legacy_folder/cert.pem
Enter Export Password: xxxxxx
Verifying - Enter Export Password: xxxxxx

Once the certificate is converted to the legacy format, it can then be uploaded to FortiManager/FortiAnalyzer under System Settings -> Certificates -> Create New/Import.

---------------------

Note: 

When a user receives a certificate in .cer format along with a private key protected by a password, it is necessary to convert it to a .pfx file.

To create a .pfx file (also known as a .p12 file) from a .cer (certificate) file and a private key, OpenSSL can be used. This command combines the certificate and its corresponding private key into a single, password-protected file — often required for server deployments or for importing into other systems.

Example command:
$ openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.cer

[Enter Export Password: xxxxxxx
Verifying - Enter Export Password: xxxxxx

Explanation of the command:

• openssl pkcs12: Uses the OpenSSL tool to handle PKCS#12 format files (.pfx/.p12).
• -export: Tells OpenSSL to export the certificate and private key into a new .pfx file.
• -out certificate.pfx: Specifies the name and location of the output .pfx file (for example, certificate.pfx).
• -inkey privateKey.key: Specifies the path to the private key file (for example, privateKey.key).
• -in certificate.cer: Specifies the path to the certificate file (for example, certificate.cer).