Import certificate

[CAD]

Hello ,

I have created CSR in Fortigate , and then got certificate(quick SSL Basic ) from third party(geo cert).

I am having trouble importing certifcate on FortiGate, when you try to import the certificate, I get the following message "Import local certificate is valid."

please help me to solve this issue.

Thanks

[CAD]

hello emnoc,

I appreciate your support.

I want start from scratch. let us forget this certificate.

1-what is best way to create certificate?

2-what is kind of certificate (format ) must request from CA-intermediate.

But if it was possible to import the current certificate to forigate  I hope to guide me to accomplish this job,Because I didn't use OpenSSL tool.

Thanks

[emnoc]

A certificate request can be done on the appliance or off. It's really not that complicated.If you do it on the fortigate just download the  CSR and sent it to the CA ( godly,entrust,geotrust,comodo, etc...) they will send you back a signed  Certificate that you import back in. This will complete the request and then you use the certificate locally for whatever you need it for.

e.g

webgui-management

sslvpn-portal

The  process is simple, 1> generate  2> download that CSR  3> import the  resulting CERT that's was signed

A 1 2 3 process

Ken

[CAD]

I have did all this steps.

already created CSR on forigate, then sent CSR to CA- Intermediate (Geo cert)

Now i have singed certificate from (Geo cert) , but i am not able to import it.

I have Received certificate on 2 format (PKCS#7,PEM-encoded)

Thanks

[emnoc]

Again paste it in the via the cli and forget the  import. Does pastng it in works?

e.g 

config  vpn certificate local 

   edit < cert_name>

     set certificate "

-----BEGIN CERTIFICATE-----

MIIGijCCBHKgAwIBAgIDEpVTMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv

b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ

Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y

dEBjYWNlcnQub3JnMB4XDTE2MTIxNDA0MjEyN1oXDTE3MDYxMjA0MjEyN1owHzEd

MBsGA1UEAxMUZ2hvc3Quc29jcHVwcGV0cy5jb20wggEiMA0GCSqGSIb3DQEBAQUA

A4IBDwAwggEKAoIBAQCdAG3DCawmyUl5/hu7drqoFGP6YYgy4Kky/pvrj7nZAgxj

HEgNRpFOVp7zIRET8rMv+6pPTQAqZiOIWCuxlqnS2vWsCJkI/wnEGKmb+yOnPNwi

DUXjTDMz1AU0xobIjAwaeT5NZfe5o5ljs6/b1FT9L6AfySaA3F8YyjorIfsjYUNm

GAEr2pSlR87F8QCRdBOzl1q9GNm72+kEpguPscqqvUAIx3SePHs/6Ne1ROfJbUxf

rpFrjS4OIFO+3CEPtEkWBpqfPZKm9NIOM60JdoeNCvypqoDOrgg1pC3vg0b3tg70

9+zWKvuysrFL14cbGHlH9PtsoYDKPStJF2mheiODAgMBAAGjggJzMIICbzAMBgNV

HRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIDqDA0BgNVHSUELTArBggrBgEFBQcDAgYI

KwYBBQUHAwEGCWCGSAGG+EIEAQYKKwYBBAGCNwoDAzAzBggrBgEFBQcBAQQnMCUw

IwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmNhY2VydC5vcmcvMDEGA1UdHwQqMCgw

JqAkoCKGIGh0dHA6Ly9jcmwuY2FjZXJ0Lm9yZy9yZXZva2UuY3JsMIIBrwYDVR0R

BIIBpjCCAaKCFGdob3N0LnNvY3B1cHBldHMuY29toCIGCCsGAQUFBwgFoBYMFGdo

b3N0LnNvY3B1cHBldHMuY29tghVnaG9zdDIuc29jcHVwcGV0cy5jb22gIwYIKwYB

BQUHCAWgFwwVZ2hvc3QyLnNvY3B1cHBldHMuY29tghVnaG9zdDMuc29jcHVwcGV0

cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hvc3QzLnNvY3B1cHBldHMuY29tghVnaG9z

dDQuc29jcHVwcGV0cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hvc3Q0LnNvY3B1cHBl

dHMuY29tghVnaG9zdDUuc29jcHVwcGV0cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hv

c3Q1LnNvY3B1cHBldHMuY29tghVnaG9zdDYuc29jcHVwcGV0cy5jb22gIwYIKwYB

BQUHCAWgFwwVZ2hvc3Q2LnNvY3B1cHBldHMuY29tghVnaG9zdDcuc29jcHVwcGV0

cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hvc3Q3LnNvY3B1cHBldHMuY29tMA0GCSqG

SIb3DQEBCwUAA4ICAQBJDW7FQeh1GwVNCAjSi9MP0LA+wRuIEx3mpRYQT7Cfoz6l

wR9dhdEJSPYg4GJtS3IOwsBAEimS/yISdG7xApMevAu4p+P/hnh7S7BTRl3XWOV7

/+aNMPLn+QvSPSfEAOkDj3e7oJf54hi/+XZH1bqOFfAvtg9J5/Py0AC6LbY5lkoC

kLuUNkRkuxjspE9DqX8I93sErgdeTKtBwlRB+3nWaKIOkrRs19gjxk75+KZAWUku

G+YpPUPVcNJxjT6TyVkpDY71T9JQZC40S7HHm59Q0da6vYjjjibnJ8yOdW9n1yZV

cTe6zgEP1rcX1xli1oVVsYFH+aVAEAVTtJqL2gPR/DFWdh6h88MKEdEA6YbObvyC

uaDVG3aCuS1gaagDtlVtNGCLDBcP/aEa7y2Xtt0SPN6GzxQI0YKpkKLQPTXldx65

MtLgl8FIDHYOe7x087Dg8LqrQzx51ykgBe1sHzhyeYL5nxPzcckasvne2tzn7M9+

ZucP6Fg4JTNt9/PiFa5g2SNMIejbzXaxoTphQ+a5oQrA0Z6tMiOH0SxOWKVD1Cd7

A2UBdTJKB/bOceft3s1puqMVM4V3p9+TPRphv5sLbl97eXvIjOUL3gmh3XDZH8a8

EadbLAoEIfjHDGEFT2IaykD3jeEfputlxBTnLVQL3qw9qGEJnor/SqcL3KVmlw==

-----END CERTIFICATE-----

 "

end

If the certificate does NOT match the key, the FortigateOS will re-ject it with a mis-match error.

Ken

[CAD]

Sorry for delay reply ,

Thanks you emnoc ,

now the certificate changed from bending to OK

have been appointed this certification for admin web gui management. but,still cross red appear in browser.

(global) # get | grep admin-server-cert admin-server-cert : Ssl-VPN-cer

any advise please

Thanks

[emnoc]

Things to   explore for the  "red".

Who signed it? Is it a trusted CA? What's the "exact error present in the browsers"

paste the  certificate that was  import here 

e.g

"BEGIN CERTIFICATE  ------> END CERTIFICATE"

Do you have a proper FQDN  entry?

Did you run ssllab against the  host?

[CAD]

Who signed it?GEO Certs

Is it a trusted CA? Yes

What's the "exact error present in the browsers? This page is insecure (broken HTTPS).

Certificate Error There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID).    

[terry_vos]

CAD,

I was ignorant about importing SSL certs until earlier in May. Once I finally got the certs properly installed, I created a Wiki of my steps (pulling some information from the PDF noted at the bottom). I'll share them below in hopes that they will help you. btw, part of my original problem was an extra space at the end of my new CSR. I inadvertently added one when copying, the CA did not that extra space. 

Generate a Certificate Signing Request (CSR) - for new or reissued Certificate 1. Log into FortiGate unit -> System -> Certificates -> Generate 2. Entered required information in the Generate Certificate Signing Request screen

a. Ensure certificate has a unique name b. Select Domain Name in the ID Type field c. An email address is Required d. Ensure that the Key Size is set to 2048 Bit e. Set the Enrollment Method to File Based f. Select OK to create the CSR. The CSR will be added to the certificate list with a status of PENDING 3. Select the new CSR in the Local Certificates page and select Download to save the CSR to your computer

Import the signed certificate into FortiGate 1. Download to files from CA - SSL certificate and CA Bundle. 2. Unzip the SSL certificate downloaded from the CA - you will only use STAR.MyDomainName.crt from this file grouping 3. Rename the .TXT file downloaded from CA Bundle to .crt. 4. Log into FortiGate unit -> System -> Certificates -> Import -> Local Certificate -> locate and select STAR.MyDomainName.crt -> Import 5. The status of the certificate will change from PENDING to OK 6. Import the CA certificate (file from CA Bundle) by selecting Import -> CA Certificate.  Apply New Certificate to Sites Locate original certificates on FortiGate -> select Ref number -> update certificate to new uniquely named cert Apply and Test Instruction taken from How-To-Buy-&-Import-SSL-Certificate_-_9.pdf