Technical Tip: Import PFX certificate to FortiManager/FortiAnalyzer via the CLI

[asrour]

Description	This article describes how to import a PFX certificate to FortiManager/FortiAnalyzer via the CLI. PEM and PFX (also known as PKCS #12) are both formats of X.509 Certificate.  PEM is Base64 ASCII encoded and can be viewed in a text editor while PFX is in Binary format, not human-readable
Scope	FortiManager / FortiAnalyzer.
Solution	To upload an SSL Certificate to FortiManager/FortiAnalyzer via the CLI, it must be in the PEM format. If the cert is in PFX, convert the PFX to PEM using any third party tool. In this example, SSL shopper is used. Upload the PFX certificate to the online tool and enter its password, then select convert. The PEM certificate will be downloaded. In this example, the downloaded file will be test-certificate.pem. Right-click the .pem file and open it using a text editor such as notepad. The text editor will open the file as below: Copy the first paragraph from the start of where it says '-----BEGIN PRIVATE KEY-----' until the end of where it says '-------END ENCRYPTED PRIVATE KEY----- '. Copy the second paragraph, which is the certificate, from the start of where it says '-----BEGIN CERTIFICATE-----' until the end of where it says '-----END CERTIFICATE-----'. Ignore the third paragraph (which is the CA Bundle File) and the other text in the file. Log in to the FortiManager or FortiAnalyzer or connect via SSH. In the CLI console: config system certificate local  <- Note that in this case, a local certificate is being uploaded. Use the same method for other certificate types, but change 'local' to the corresponding type edit “test-certificate”   <- Give a name to the cert. set private-key  paste the first paragraph set certificate  paste the second paragraph end The certificate is saved in the FortiManager/FortiAnalyzer under System Settings -> Certificates and ready to be used.