Hello ,
I have created CSR in Fortigate , and then got certificate(quick SSL Basic ) from third party(geo cert).
I am having trouble importing certifcate on FortiGate, when you try to import the certificate, I get the following message "Import local certificate is valid."
please help me to solve this issue.
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Sorry , i mean "Import local certificate is invalid"
I have also followed the instructions below to import certificate
Import the signed certificate into your FortiGate device
1. Unzip the file downloaded from the CA. There should be two .CRT files: a CA certificate with bundle in the file name, and a local certificate. 2. Log in to your FortiGate unit and browse to System > Certificates. 3. Select Import > Local Certificate to import the local certificate.
The status of the certificate will change from PENDING to OK. 4. Import the CA certificate by selecting Import > CA Certificate. It will be listed in the CA Certificates section of the certificates list.
any insight please.
Do you still have the CSR on the FortiGate? If you removed it, you might get such an error on import. https://forum.fortinet.com/tm.aspx?m=56019
In the steps you listed above, I'm assuming the error was on 3?
thanks for reply.
Yes, the error on step 3.
the CSR still exist.
i need help
Thanks
You should probably open a support ticket with Fortinet support -- they can often remote in and take a look pretty quickly.
A few more questions, in case people in the forum can figure this out.
- Which version of FortiOS are you running?
- In what format did you get the signed certificate back from your CA?
How many files and with what extensions, etc.
I would have expected the CA to give you a single, signed .CRT certificate.
- Have you tried importing the certificate using the other import options?
fwiw
i would use a csr and cert checker tool online to validate the cert and csr or use openssl
openssl req -in <csrname> -noout -text
openssl x509 -in <certname> -noout -text
if these 2 or primary the latter are successful than check the key
openssl x509 -in <certname> -noout -modulus | openssl md5
openssl rsa -in <keyname> -noout -modulus | openssl md5
make sure you extract the key and login into the f5 and add the certificates via the cli. The webgui has been problematic for some time now.
PCNSE
NSE
StrongSwan
Sorry for delay reply,
I have ran the first command against two certificates, but got the below error:
"OpenSSL> req -in CA_Bundle.crt -noout -text
unable to load X509 request 6628:error:0906D06C:PEM routines:PEM_read_bio:no start :691:Expecting: CERTIFICATE REQUEST error in req
OpenSSL> req -in SSL_domain.crt -noout -text problem creating object tsa_policy1=1.2.3.4.1 6628:error:08064066:object identifier routines:OBJ_create:oid exists:crypto\obje cts\obj_dat.c:689: error in req"
The second command working fine.
How can extract the privatekey.
Thanks
1> "req" is for reading a CSR request, x509 is for the certificate to convert a privacy from enc to non-enc
2 > openssl rsa -in <keynamewithencryption> -out < new namer the key>
openssl will challenge you for the RSA key passphrase
PCNSE
NSE
StrongSwan
thanks for reply ,
i got the following error:
"5136:error:0906D06C:PEM routines:PEM_read_bio:no start line:crypto\pem\pem_lib.c :691:Expecting: ANY PRIVATE KEY error in rsa"
this is the first time was used this tool (openssl). Could you please help me to to accomplish this.
Thanks
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.