Multi SAN VPN Certificate

[martyyy]

Hi,

We run 3 firewalls for VPN connections.
I created a CR on the first one and we generated a multi SAN certificate which was uploaded and works fine.
I tried the same cert on the other two and i get an error saying there is no CR for this certificate.

Error message: Uploaded certificate has no matching certificate signing request (CSR)

Does each FW require a seperate CR to generate a different multi san cert?

TIA :) 

[AEK · Accepted solution]

Hi Marty

That's normal because when you import the signed cert to the first FGT it finds the related private key (generated and stored in FGT when CSR was created), while the two others don't have any related private key.

You cannot export the private key through the GUI. But you can from the CLI.

conf cert local
show full

You will then need to store the private key in a .key file and import it with the signed cert on the other firewalls.

Hope it helps.