Certificate Chain not reflecting on admin GUI

Hi,

If you've a comercial certificate like this issued by Sectigo, I asume you can build a PFX file with the private key  and make it available to import as PKCS#12 file
Also import CA certificate provided by Sectigo; 
That should be enough, without manipulation of leaf, intermediate etc, because Sectigo provides the complete CA and certificate file when signs.
If SSL Labs checks fails, and you have all certificate files provided by the CA, is often a matter of order of files.

hope it helps

 

Ok
we agree on this issue it's not related with the Fortigate; same problem would occur with that certificates directly configured in a webserver.
Import as a PFX container or using key, certificate etc, is the same thing; PFX way is easier because you only need container pass,
So, I'll explore the problem working with the certificate itself.
Remove all those certificates related with this, and restart; 
Sectigo provides several types of certifcate, and CA for each of them.

Also provides a bundle with all certificates signing its certificates
https://sectigostore.com/page/sectigo-ca-bundle/

Importing that bundle could cover all the variants

Hope it helps

​​

do i need to include the bundles in the above link while creating the pfx OR upload the bundle as a separate file under CA Certs ?

One more thing which i noticed was that when i run an openssl command against the Firewall IP .. it does not fetch the intermediate cert at all ..it just shows the leaf , that makes me wonder if there is something at fortigate which is not presenting the entire chain with the leaf… i double checked the pfx which was imported and it had leaf + intermediate so it doesnt seem like a pfx issue in that regard