Attempt to generate a CSR, errors " The imported local certificate is invalid"

[Jay_Libove]

I' m trying to generate a Certificate Signing Request for a new Local Certificate (which I would then send to a real CA) so that I can have a proper SSL Certificate for SSLVPN use as well as Admin web GUI use. Steps: Go to System -> Certificates -> Local Certificates, click on Generate, fill in this data: Certificate Name: SPFGSSLVPNcrt3 ID Type: Domain Name Domain name: fgsslvpn.socialpoint.es Org Unit: <empty> Org: Social Point, S.L. Locality: Barcelona State: Catalunya Country: Spain email: security@socialpoint.es SAN: rpv.socialpoint.es Type: RSA Bits: 2048 Enrollment method: File Based click OK, get error " The imported local certificate is invalid" . That' s particularly weird, because I haven' t imported a certificate - I' m trying to generate a new private key inside the FG100D and create a .CSR. Attempting to generate a CSR from the CLI similarly fails: FG100D3G13807731 # execute vpn certificate local generate SPFGSSLVPNcrt3 2048 spfgsslvpn.socialpoint.es Spain Catalunya Barcelona " Social Point, S.L." " " security@socialpoint.es rpv.socialpoint.es Generating a 2048 bit RSA private key Generating X.509 certificate failed to create extension: -4 problems making Certificate Request Certificate generation failed Done. (I also tried variations where no " quoted strings" were needed, and where I used an OrgUnit instead of " " to leave the orgunit blank; it always fails with this same error). Any magic sauce to get my FortiGate FG100D, FortiOS 5.0.3 firmware to allow me to generate a private key and a Certificate Signing Request, please? Alternatively, any way I can import a full key+certificate generated completely outside of the FortiGate, to avoid the need to generate a CSR on the FortiGate? thanks,

[emnoc]

Could be a bug ? What various of code? my FWF60D executed the same exact outcome for either ip or domain type certs. On your last question; any way I can import a full key+certificate generated completely outside of the FortiGate, to avoid the need to generate a CSR on the FortiGate? Yes it' s called openssl and you craft your prig-key and car, get the csr signed and then import it into the FGT.

[emnoc]

Hey I played around on a FWF60D after this strike my curiosity. What I found, the CT ST identifiers have to be correct. Also my unit was failing on c CSR but for some reasons left defunct CSR that was only displaying in the CLI. e.g all of these failed CSR are not displayed or have the ability to be deleted within the GUI. Also add a link to my blog and a post on how to craft a CSR with openssl http://socpuppet.blogspot.com/2013/04/openssl-trick3-sserver.html

[Jay_Libove]

Hi emnoc, and many thanks. I also found that, trying to generate the CSR at the CLI, would leave an orphaned " certificate" , not visible in the GUI (but deleteable easily enough at the CLI). About generating a key and cert off-box, yes, OpenSSL, etc I' ve used many times in other contexts; what I haven' t found in the context of the FortiGate is documentation explaining the format in which to put a combined private key + certificate so that the FortiGate will import it. What format did you use from which the FortiGate would successfully import both the certificate and the private key? Is this documented somewhere? (2400 pages of documentation in the Handbook, but not about this...) -> updated: Well, it is in the Handbook, although only in the context of an example, not actually documented. Handbook v5.0, date July 11, 2013, page 935, example " Generate and Import CA certificate with private key pair on OpenSSL" . About the certificate State identifier, you noted that " the CT ST identifiers have to be correct" . I' m pretty sure that the information I input, State: Catalunya (and all the rest), is correct. Certainly DigiCert is happy with it in our other certificates. Could you tell us a bit more please about what you found about the ST field? Thanks!

[Jay_Libove]

Ah. To import a certificate *** and a private key *** the import type is " Certificate" . Wow, how obvious... (Documentation, seriously...) So, my admin SSL web interface now works fine. [ getting off-topic here ] But my SSL VPN... * on Android, still gives a(n undisclosed) certificate error, but will connect if I give the client the okay to do so * on Linux, now won' t connect at all. Just says " connecting..." . A packet capture shows an SSL handshake, and then .. nothing. This Linux behaviour is consistent whether I enter a correct userID+password combination or not. So it' s in the SSL handshake where the Linux SSLVPN client is now getting stuck, where before (using the self-sign cert on the FG100D) it would connect correctly. Sigh. To prove the point, I switched the FortiGate SSLVPN configuration back to using the self-signed certificate, and the Linux client would again connect, so it' s definitely an issue with how the Linux client deals with a real SSL certificate on the FortiGate SSLVPN server. Ah, got it. I also had to upload the public CA' s root cert to the FortiGate. Why that should be necessary for the CLIENT to validate a PUBLIC CA' s cert is beyond me, but that seems to have fixed the problem. Could anyone else confirm a similar experience? cheers, Jay

[emnoc]

I also had to upload the public CA' s root cert to the FortiGate On the latter, you can use openssl and verify against the certificate to verify. I think that' s why the CA needs to be install. It all about certificate chaining and intermediates iirc. Glad it all worked out for you. I' m still investigating the orphans as you call it and why we don' t have these in the portal.

[Jay_Libove]

D****, I missed that. I thought I' d uploaded the (true) root CA cert, but in fact it was a chained root cert that I uploaded. I do wish that chained root evaluation were a more standard feature in clients... thanks, -Jay

[Jay_Libove]

Got the answer about why the generate commands wouldn' t work. The simple case was " it works if I don' t try to specify a SAN" . The more complex case was " FortiOS expects the SAN to be specified explicitly with a content type:content" , e.g. not just " otherhostname.mydomain.com" but " DNS:otherhostname.mydomain.com" , or " email:myemail@address.com" . Fully specifying the type of the content of the SAN, a colon: and then the content, does work at the CLI and also in the GUI. I have asked FortiNet to update the CLI ? help, the Handbook and the GUI screen.

[emnoc]

Good work, and a nice tidbit of information to have ; if generation of a CSR from the CLI or GUI. What I did earlier when this ticket caught my eye, was to mimic everything in the fortinet factory certs to see what field(s) might have been an issue.

[rabzy]

Hello Guys, I want to create a CSR for my fortigate. But when i download it and open it with notepad, i can a blank text. What could be wrong.