Troubleshooting Tip: Loading a PKCS#12 Certificate in FortiManager/FortiAnalyzer gives a wrong password error

• Loading an OpenSSL generated PKCS#12 certificate in FortiManager/FortiAnalyzer using FTP gives the error:

FMG-VM64 # execute certificate local import-pkcs12 ftp <IP:port> <filename> <server username> <server password> <cert password> <name for cert>
Starting transfer PKCS#12 file from FTP server...
Transferred 0.003M of 0.003M in 0:00:00s (0.021M/s)
Starting import PKCS#12 file...
Failed: could not load the shared library (wrong password?)
Failed.
Command fail. Return code -26

• The error can occur in general when the password is indeed incorrect.
• This can also occur because of the certificate being generated using older OpenSSL versions, which most often use weak encryption algorithms.
• Since FortiManager/FortiAnalyzer v7.4.2 the supported OpenSSL version is upgraded to v3.1.2.
• Regenerate the certificate using the latest version of OpenSSL (v3.1.2 or higher).
• Load the new certificate to FortiManager/FortiAnalyzer:

FMG-VM64 # execute certificate local import-pkcs12 ftp <IP:port> <filename> <server username> <server password> <cert password> <name for cert>
Starting transfer PKCS#12 file from FTP server...
Transferred 0.004M of 0.004M in 0:00:00s (0.164M/s)
Starting import PKCS#12 file...
Done.

Related documents:

Certificate - CLI Reference

Technical Tip: How to generate certificates using OpenSSL

Technical Tip: Certificate Generation with FIPS Enabled on FortiAnalyzer and FortiGate