Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
CAD
Contributor

Import certificate

Hello ,

I have created CSR in Fortigate , and then got certificate(quick SSL Basic ) from third party(geo cert).

 

I am having trouble importing certifcate on FortiGate, when you try to import the certificate, I get the following message "Import local certificate is valid."

 

please help me to solve this issue.

 

Thanks

27 REPLIES 27
CAD
Contributor

Sorry , i mean "Import local certificate is invalid"

 

I have also followed the instructions below  to import certificate

 

Import the signed certificate into your FortiGate device

1. Unzip the file downloaded from the CA. There should be two .CRT files: a CA certificate with bundle in the file name, and a local certificate. 2. Log in to your FortiGate unit and browse to System > Certificates. 3. Select Import > Local Certificate to import the local certificate.

The status of the certificate will change from PENDING to OK. 4. Import the CA certificate by selecting Import > CA Certificate. It will be listed in the CA Certificates section of the certificates list.

 

CAD
Contributor

any insight please.

tanr
Valued Contributor II

Do you still have the CSR on the FortiGate?  If you removed it, you might get such an error on import. https://forum.fortinet.com/tm.aspx?m=56019

 

In the steps you listed above, I'm assuming the error was on 3?

CAD
Contributor

thanks for reply.

 

Yes, the error on step 3.

the CSR still exist.

i need help 

 

Thanks 

tanr
Valued Contributor II

You should probably open a support ticket with Fortinet support -- they can often remote in and take a look pretty quickly.

 

A few more questions, in case people in the forum can figure this out.

 

- Which version of FortiOS are you running?

- In what format did you get the signed certificate back from your CA?  

  How many files and with what extensions, etc.  

  I would have expected the CA to give you a single, signed .CRT certificate.

- Have you tried importing the certificate using the other import options?

 

emnoc
Esteemed Contributor III

fwiw

 

i would use a  csr and cert checker tool online to validate the  cert and csr or use openssl

 

 

openssl req -in <csrname>  -noout -text

openssl  x509 -in <certname> -noout -text

 

if these 2 or primary the latter are successful than  check the key

 

openssl  x509 -in <certname> -noout -modulus | openssl md5

openssl rsa -in <keyname> -noout -modulus | openssl md5

 

make sure you extract the key and  login into  the  f5 and add the certificates via the cli. The webgui has been problematic for some time now.

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
CAD
Contributor

Sorry for delay reply,

I have ran the first command against two certificates, but got the below error:

 

"OpenSSL> req -in CA_Bundle.crt -noout -text

unable to load X509 request 6628:error:0906D06C:PEM routines:PEM_read_bio:no start :691:Expecting: CERTIFICATE REQUEST error in req

OpenSSL> req -in SSL_domain.crt -noout -text problem creating object tsa_policy1=1.2.3.4.1 6628:error:08064066:object identifier routines:OBJ_create:oid exists:crypto\obje cts\obj_dat.c:689: error in req"

 

The second command working fine.

How can extract the privatekey.

Thanks 

emnoc
Esteemed Contributor III

1>  "req" is for reading a CSR request,  x509 is for the certificate to convert a privacy from enc to non-enc

 

 

2 > openssl rsa -in <keynamewithencryption>  -out < new  namer the key>

 

openssl will challenge you for the RSA key passphrase

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
CAD

thanks for reply ,

 

 i got the following error:

"5136:error:0906D06C:PEM routines:PEM_read_bio:no start line:crypto\pem\pem_lib.c :691:Expecting: ANY PRIVATE KEY error in rsa"

 

this is the first time  was used this tool (openssl). Could you please help me to to accomplish this. 

 

 

Thanks

Labels
Top Kudoed Authors