Hello ,
I have created CSR in Fortigate , and then got certificate(quick SSL Basic ) from third party(geo cert).
I am having trouble importing certifcate on FortiGate, when you try to import the certificate, I get the following message "Import local certificate is valid."
please help me to solve this issue.
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
hello emnoc,
I appreciate your support.
I want start from scratch. let us forget this certificate.
1-what is best way to create certificate?
2-what is kind of certificate (format ) must request from CA-intermediate.
But if it was possible to import the current certificate to forigate I hope to guide me to accomplish this job,Because I didn't use OpenSSL tool.
Thanks
A certificate request can be done on the appliance or off. It's really not that complicated.If you do it on the fortigate just download the CSR and sent it to the CA ( godly,entrust,geotrust,comodo, etc...) they will send you back a signed Certificate that you import back in. This will complete the request and then you use the certificate locally for whatever you need it for.
e.g
webgui-management
sslvpn-portal
The process is simple, 1> generate 2> download that CSR 3> import the resulting CERT that's was signed
A 1 2 3 process
Ken
PCNSE
NSE
StrongSwan
I have did all this steps.
already created CSR on forigate, then sent CSR to CA- Intermediate (Geo cert)
Now i have singed certificate from (Geo cert) , but i am not able to import it.
I have Received certificate on 2 format (PKCS#7,PEM-encoded)
Thanks
Again paste it in the via the cli and forget the import. Does pastng it in works?
e.g
config vpn certificate local
edit < cert_name>
set certificate "
-----BEGIN CERTIFICATE-----
MIIGijCCBHKgAwIBAgIDEpVTMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv
b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
dEBjYWNlcnQub3JnMB4XDTE2MTIxNDA0MjEyN1oXDTE3MDYxMjA0MjEyN1owHzEd
MBsGA1UEAxMUZ2hvc3Quc29jcHVwcGV0cy5jb20wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQCdAG3DCawmyUl5/hu7drqoFGP6YYgy4Kky/pvrj7nZAgxj
HEgNRpFOVp7zIRET8rMv+6pPTQAqZiOIWCuxlqnS2vWsCJkI/wnEGKmb+yOnPNwi
DUXjTDMz1AU0xobIjAwaeT5NZfe5o5ljs6/b1FT9L6AfySaA3F8YyjorIfsjYUNm
GAEr2pSlR87F8QCRdBOzl1q9GNm72+kEpguPscqqvUAIx3SePHs/6Ne1ROfJbUxf
rpFrjS4OIFO+3CEPtEkWBpqfPZKm9NIOM60JdoeNCvypqoDOrgg1pC3vg0b3tg70
9+zWKvuysrFL14cbGHlH9PtsoYDKPStJF2mheiODAgMBAAGjggJzMIICbzAMBgNV
HRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIDqDA0BgNVHSUELTArBggrBgEFBQcDAgYI
KwYBBQUHAwEGCWCGSAGG+EIEAQYKKwYBBAGCNwoDAzAzBggrBgEFBQcBAQQnMCUw
IwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmNhY2VydC5vcmcvMDEGA1UdHwQqMCgw
JqAkoCKGIGh0dHA6Ly9jcmwuY2FjZXJ0Lm9yZy9yZXZva2UuY3JsMIIBrwYDVR0R
BIIBpjCCAaKCFGdob3N0LnNvY3B1cHBldHMuY29toCIGCCsGAQUFBwgFoBYMFGdo
b3N0LnNvY3B1cHBldHMuY29tghVnaG9zdDIuc29jcHVwcGV0cy5jb22gIwYIKwYB
BQUHCAWgFwwVZ2hvc3QyLnNvY3B1cHBldHMuY29tghVnaG9zdDMuc29jcHVwcGV0
cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hvc3QzLnNvY3B1cHBldHMuY29tghVnaG9z
dDQuc29jcHVwcGV0cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hvc3Q0LnNvY3B1cHBl
dHMuY29tghVnaG9zdDUuc29jcHVwcGV0cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hv
c3Q1LnNvY3B1cHBldHMuY29tghVnaG9zdDYuc29jcHVwcGV0cy5jb22gIwYIKwYB
BQUHCAWgFwwVZ2hvc3Q2LnNvY3B1cHBldHMuY29tghVnaG9zdDcuc29jcHVwcGV0
cy5jb22gIwYIKwYBBQUHCAWgFwwVZ2hvc3Q3LnNvY3B1cHBldHMuY29tMA0GCSqG
SIb3DQEBCwUAA4ICAQBJDW7FQeh1GwVNCAjSi9MP0LA+wRuIEx3mpRYQT7Cfoz6l
wR9dhdEJSPYg4GJtS3IOwsBAEimS/yISdG7xApMevAu4p+P/hnh7S7BTRl3XWOV7
/+aNMPLn+QvSPSfEAOkDj3e7oJf54hi/+XZH1bqOFfAvtg9J5/Py0AC6LbY5lkoC
kLuUNkRkuxjspE9DqX8I93sErgdeTKtBwlRB+3nWaKIOkrRs19gjxk75+KZAWUku
G+YpPUPVcNJxjT6TyVkpDY71T9JQZC40S7HHm59Q0da6vYjjjibnJ8yOdW9n1yZV
cTe6zgEP1rcX1xli1oVVsYFH+aVAEAVTtJqL2gPR/DFWdh6h88MKEdEA6YbObvyC
uaDVG3aCuS1gaagDtlVtNGCLDBcP/aEa7y2Xtt0SPN6GzxQI0YKpkKLQPTXldx65
MtLgl8FIDHYOe7x087Dg8LqrQzx51ykgBe1sHzhyeYL5nxPzcckasvne2tzn7M9+
ZucP6Fg4JTNt9/PiFa5g2SNMIejbzXaxoTphQ+a5oQrA0Z6tMiOH0SxOWKVD1Cd7
A2UBdTJKB/bOceft3s1puqMVM4V3p9+TPRphv5sLbl97eXvIjOUL3gmh3XDZH8a8
EadbLAoEIfjHDGEFT2IaykD3jeEfputlxBTnLVQL3qw9qGEJnor/SqcL3KVmlw==
-----END CERTIFICATE-----
"
end
If the certificate does NOT match the key, the FortigateOS will re-ject it with a mis-match error.
Ken
PCNSE
NSE
StrongSwan
Sorry for delay reply ,
Thanks you emnoc ,
now the certificate changed from bending to OK
have been appointed this certification for admin web gui management. but,still cross red appear in browser.
(global) # get | grep admin-server-cert admin-server-cert : Ssl-VPN-cer
any advise please
Thanks
Things to explore for the "red".
Who signed it? Is it a trusted CA? What's the "exact error present in the browsers"
paste the certificate that was import here
e.g
"BEGIN CERTIFICATE ------> END CERTIFICATE"
Do you have a proper FQDN entry?
Did you run ssllab against the host?
PCNSE
NSE
StrongSwan
Who signed it?GEO Certs
Is it a trusted CA? Yes
What's the "exact error present in the browsers? This page is insecure (broken HTTPS).
Certificate Error There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID).CAD,
I was ignorant about importing SSL certs until earlier in May. Once I finally got the certs properly installed, I created a Wiki of my steps (pulling some information from the PDF noted at the bottom). I'll share them below in hopes that they will help you. btw, part of my original problem was an extra space at the end of my new CSR. I inadvertently added one when copying, the CA did not that extra space.
Generate a Certificate Signing Request (CSR) - for new or reissued Certificate 1. Log into FortiGate unit -> System -> Certificates -> Generate 2. Entered required information in the Generate Certificate Signing Request screen
a. Ensure certificate has a unique name b. Select Domain Name in the ID Type field c. An email address is Required d. Ensure that the Key Size is set to 2048 Bit e. Set the Enrollment Method to File Based f. Select OK to create the CSR. The CSR will be added to the certificate list with a status of PENDING 3. Select the new CSR in the Local Certificates page and select Download to save the CSR to your computer
Import the signed certificate into FortiGate 1. Download to files from CA - SSL certificate and CA Bundle. 2. Unzip the SSL certificate downloaded from the CA - you will only use STAR.MyDomainName.crt from this file grouping 3. Rename the .TXT file downloaded from CA Bundle to .crt. 4. Log into FortiGate unit -> System -> Certificates -> Import -> Local Certificate -> locate and select STAR.MyDomainName.crt -> Import 5. The status of the certificate will change from PENDING to OK 6. Import the CA certificate (file from CA Bundle) by selecting Import -> CA Certificate. Apply New Certificate to Sites Locate original certificates on FortiGate -> select Ref number -> update certificate to new uniquely named cert Apply and Test Instruction taken from How-To-Buy-&-Import-SSL-Certificate_-_9.pdf
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.