Technical Tip: Import PFX certificate to FortiManager/FortiAnalyzer via the CLI

[asrour]

Description	This article describes how to import a PFX certificate to FortiManager/FortiAnalyzer via the CLI. PEM and PFX (also known as PKCS #12) are both formats of X.509 Certificate. If the error 'importing local certificate failed. It might already exist' is received, it is possible to use the CLI rather than the GUI to resolve it.
Scope	FortiManager/FortiAnalyzer.
Solution	To upload an SSL Certificate to FortiManager/FortiAnalyzer via the CLI, it must be in the PEM format. If the cert is in PFX, convert the PFX to PEM using any third-party tool. In this example, SSL shopper is used. Upload the PFX certificate to the online tool and enter its password, then select convert. The PEM certificate will be downloaded. In this example, the downloaded file will be test-certificate.pem. 'Right-click' the .pem file and open it using a text editor such as Notepad. The text editor will open the file as below: Copy the first paragraph from the start of where it says '-----BEGIN PRIVATE KEY-----' until the end of where it says '-------END ENCRYPTED PRIVATE KEY----- '. Copy the second paragraph, which is the certificate, from the start of where it says '-----BEGIN CERTIFICATE-----' until the end of where it says '-----END CERTIFICATE-----'. Ignore the third paragraph (which is the CA Bundle File) and the other text in the file. Log in to the FortiManager or FortiAnalyzer or connect via SSH. In the CLI console: config system certificate local  <- Note that in this case, a local certificate is being uploaded. Use the same method for other certificate types, but change 'local' to the corresponding type.     edit “test-certificate”   <- Give a name to the cert.         set private-key  paste the first paragraph         set certificate  paste the second paragraph end The certificate is saved in the FortiManager/FortiAnalyzer under System Settings -> Certificates and is ready to be used. Related articles: Technical Tip: How to upload and set local certificate to be used in FortiManager/FortiAnalyzer Technical Tip: Using an externally signed local certificate for OFTP connection Technical Tip: How to import an SSL certificate as a local certificate Technical Tip: How to configure FortiManager to use custom certificate for HA communication Technical Tip: How to Convert a PKCS#12 Certificate to Legacy Format for FortiManager/FortiAnalyzer Technical Tip: Import PFX certificate to FortiManager/FortiAnalyzer via the CLI