Technical Tip: Adding new SSL certificate to EMS Server and errors on the process

[arleniscg]

Description	This article describes how to import a new SSL certificate on EMS Server on-Premise and how to solve the errors in the process.
Scope	FortiClient.
Solution	It is possible to import a new SSL certificate on the EMS server in 2 ways. Method 1 Take a snapshot and a Backup of the EMS server (in case of a rollback, it is necessary): Option 1: On the GUI. Convert the CRT file to PEM: openssl x509 -in cert.crt -out cert.pem Combine the PEM and KEY files into the PFX file: openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt Generate a password here. Add PFX and password to EMS: Access EMS server with new SSL certificate imported.   After performing this process, an error may appear featuring a URL similar to https://localhost:port/ with error ERR_CONNECTION_REFUSED (-102): Validate the FortiClient Endpoint Management Server Apache Service is running. If it is not running, try to start or restart the Service. If error code 1 shows afterwards... ... Remove the IIS service, then restart the services through the command line as shown below and try the access to EMS server.  Option 2: Directly modify the paths of the ssl.crt and ssl.key. It will be required to separate the certificate and key. (OpenSSL can be used to extract the key and certificate.) For the key: openssl pkcs12 -in certfile.pfx -nocerts -nodes -out key.pem For the certificate: openssl pkcs12 -in certfile.pfx -clcerts -nokeys -out cert.pem Replace the SSL certificate key file and SSL certificate file. Below is how the setup looks before the modification. Replace the SSL certificate key file (go to C:\Program Files (x86)\Fortinet\FortiClientEMS\Apache24\conf\ssl.key\) and copy server.key to server.key.old. Replace the SSL certificate file (go to C:\Program Files (x86)\Fortinet\FortiClientEMS\Apache24\conf\ssl.crt\) and copy server.crt to server.crt.old. Modify accordingly to point to the new cert and key (C:\Program Files (x86)\Fortinet\FortiClientEMS\Apache24\conf\apache_django_wsgi.conf). Reboot the EMS server. Access the EMS server with the new SSL certificate imported.