Can someone help me out on this?
Got a mail from our certificate supplier about SHA1 certificates being phased out.
They supplied us with a new certificate which replaces the old one.
However this certificate is only available in .cer-format and is being sent together with just the CA certificate and the intermediate certificate.
When I try to import the certificate into the Fortimail unit, the response says: "Certificate upload: importing the CSR response failed". I get that because no CSR was created.
Question: How can I replace an existing certificate in the FortiMail with the new one which is in .cer-format only?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Did they send you a replacement cert based on the original CSR from the Fortimail? If a CSR was generated on the Fortimail and a corresponding certificate was already imported then the Fortimail won't be expecting a new one.
What you can do is grab the private key from the CLI and save it as a file...
#config system certificate local
#edit <your cert name>
#unset password
#show
Now copy everything between and including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
save as a .key file
Now import your new certificate and the private key into the Fortimail as type "certificate"
Set a new private key password.
Unsetting the password won't affect the current certificate operation. Forgot to mention that the new certificate will need to be activated by going to System ---> Certificate, select the new certificate and then "Set Status", this would restart the web server daemon for the new cert to take effect.
Did they send you a replacement cert based on the original CSR from the Fortimail? If a CSR was generated on the Fortimail and a corresponding certificate was already imported then the Fortimail won't be expecting a new one.
What you can do is grab the private key from the CLI and save it as a file...
#config system certificate local
#edit <your cert name>
#unset password
#show
Now copy everything between and including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
save as a .key file
Now import your new certificate and the private key into the Fortimail as type "certificate"
Set a new private key password.
Thanks for your response.
Yes they did, they re-issued the cerificate based on the 'old' CSR.
Will 'unsetting' the password in any way compromise the functioning of the current certificate?
I.e.: Can I do this without issues during these actions?
Unsetting the password won't affect the current certificate operation. Forgot to mention that the new certificate will need to be activated by going to System ---> Certificate, select the new certificate and then "Set Status", this would restart the web server daemon for the new cert to take effect.
Thanks, a whole lot, for your help, worked like a charm!!!
OP
Curious ,
" did they say why SHA1 was being phase out and how long did the enable you cert for ? "
and
" was the original key a 1K bit size and what size are you using now ? ( 2K bits I would hope ) "
But what the other gentlemen said is 100% correct, that's why you should always securely store the priv-key.
PCNSE
NSE
StrongSwan
Since the cert use is valid up to 2018 we were advised to replace it for a SHA2 version.
Keysize is 2K indeed.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1698 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.