Import certificate

[CAD]

Hello ,

I have created CSR in Fortigate , and then got certificate(quick SSL Basic ) from third party(geo cert).

I am having trouble importing certifcate on FortiGate, when you try to import the certificate, I get the following message "Import local certificate is valid."

please help me to solve this issue.

Thanks

[CAD]

Sorry , i mean "Import local certificate is invalid"

I have also followed the instructions below  to import certificate

Import the signed certificate into your FortiGate device

1. Unzip the file downloaded from the CA. There should be two .CRT files: a CA certificate with bundle in the file name, and a local certificate. 2. Log in to your FortiGate unit and browse to System > Certificates. 3. Select Import > Local Certificate to import the local certificate.

The status of the certificate will change from PENDING to OK. 4. Import the CA certificate by selecting Import > CA Certificate. It will be listed in the CA Certificates section of the certificates list.

[CAD]

any insight please.

[tanr]

Do you still have the CSR on the FortiGate?  If you removed it, you might get such an error on import. https://forum.fortinet.com/tm.aspx?m=56019

In the steps you listed above, I'm assuming the error was on 3?

[CAD]

thanks for reply.

Yes, the error on step 3.

the CSR still exist.

i need help 

Thanks 

[tanr]

You should probably open a support ticket with Fortinet support -- they can often remote in and take a look pretty quickly.

A few more questions, in case people in the forum can figure this out.

- Which version of FortiOS are you running?

- In what format did you get the signed certificate back from your CA?  

  How many files and with what extensions, etc.  

  I would have expected the CA to give you a single, signed .CRT certificate.

- Have you tried importing the certificate using the other import options?

[emnoc]

fwiw

i would use a  csr and cert checker tool online to validate the  cert and csr or use openssl

openssl req -in <csrname>  -noout -text

openssl  x509 -in <certname> -noout -text

if these 2 or primary the latter are successful than  check the key

openssl  x509 -in <certname> -noout -modulus | openssl md5

openssl rsa -in <keyname> -noout -modulus | openssl md5

make sure you extract the key and  login into  the  f5 and add the certificates via the cli. The webgui has been problematic for some time now.

[CAD]

Sorry for delay reply,

I have ran the first command against two certificates, but got the below error:

"OpenSSL> req -in CA_Bundle.crt -noout -text

unable to load X509 request 6628:error:0906D06C:PEM routines:PEM_read_bio:no start :691:Expecting: CERTIFICATE REQUEST error in req

OpenSSL> req -in SSL_domain.crt -noout -text problem creating object tsa_policy1=1.2.3.4.1 6628:error:08064066:object identifier routines:OBJ_create:oid exists:crypto\obje cts\obj_dat.c:689: error in req"

The second command working fine.

How can extract the privatekey.

Thanks 

[emnoc]

1>  "req" is for reading a CSR request,  x509 is for the certificate to convert a privacy from enc to non-enc

2 > openssl rsa -in <keynamewithencryption>  -out < new  namer the key>

openssl will challenge you for the RSA key passphrase

[CAD]

thanks for reply ,

 i got the following error:

"5136:error:0906D06C:PEM routines:PEM_read_bio:no start line:crypto\pem\pem_lib.c :691:Expecting: ANY PRIVATE KEY error in rsa"

this is the first time  was used this tool (openssl). Could you please help me to to accomplish this. 

Thanks