I have searched high and low, but cannot get a clear answer on this, created a CSR last year for a Fortigate, got it signed by ROOT CA, installed cert and used it for SSL VPN, no problem at all. Now its renewal time, got the new cert from the signing authority GODADDY, and I cant install it?
I have the ROOT CA cert on there, so I goto Certificates > import > Certificate > Local certificate, select my .cer file
and I get this "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL.cert" I assumed I would delete the old one and replace with this one, same issue? any help please? the troubleshooting link for this error is not helpful, I really dont understand why it doesnt work
Thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
My reading of your original post is that you started by creating a CSR on the FortiGate. This generates two "things": the CSR itself, and a matching private key.
When you the uploaded the signed certificate for the first time, it was matched to the private key. So now you should have the private key and the "old" certificate as an object in "config vpn certificate local", unless you deleted it already.
Assuming you haven't sent any new CSR to your CA, that implies that the new certificate they provided you still matches to the "old" private key. So the goal is to have the old privkey + new certificate in a single object in the FortiGate configuration.
That can be achieved by one of the two methods I described in my other reply:
1, Manually edit the old/existing object, and replace the old "set certificate" value with the new one.
2, Upload the privkey and the new certificate as a new object. For that you will need to export the private key out of the configiration, which can only be done if you know the password for the private key. (if you set the password manually during CSR generation and still remember it, you can; otherwise it is not possible)
2b, (alternative) Copy the entrire CLI content of the existing object, edit it in an editor, then paste it in as a new object:
- show full vpn certificate local <old-cert-object-name>
- copy that into a text editor (notepad, notepad++, etc.)
- change the name (edit "oldname" -> edit "newname")
- update the 'set certificate "xxxxx"' content, replace it with the new certificate.
- copy the entire modified snippet and paste it into FortiOS CLI.
-> this should create a new certificate object with the new certificate and the old private key (without having to know the password).
Team,
You can check this article that might help you with this:
That's the article I am referring too, it isn't helpful to my problem. I have the .CRT file, that's all I need , as I have the root already installed.
The new certificate will need a new private key, it can't use the old/existing private key even though it may come from the same root CA.
You need to create a new CSR or import the new certificate together with the new private key.
Thats a strange way to do it? I have the new cert, where can I get the private key from then?
This is pretty standard for every vendor or PKI implementation. The certificate without a private key can not be used. There are some certificate formats that include the private key in the file like PKCS #12 that appear as files with extensions '.pfx' or '.p12', certificate files '.cer' or '.crt' doesn't contain a private key.
Note, the extensions are just as reference and usually not important to the actual content.
If the certificate request is generated by FGT as a CSR, you will not need a private key and it will not be created by the CA, it will be calculated locally in FGT.
So it needs a new CSR every time in needs renewing? that doesn't sound right to me, Can I not get the ROOT Authority to give me the PKCS12 file?
Yes, usually public CAs will offer different formats in a bundle ready to import for Apache or IIS/Exchange. The later one will be a single .pfx file (PKCS #12) and password protected.
well, thats the first time ever, I have had to create a new CSR on a yearly renewal, I dont use password protection, all I want is a cert file, I have created a new CSR ready to ne signed, I cant do it now, as the provider revokes the old certificate! very very convulted way to do this, in the past, I have just asked for a new .crt and it gets sent to me! as the Fortigate is the same device, no new CSR needed.
@TheOnlyJames
You may try to add certificate content via cli
Open your new certificate crt with a notepad, and copy all content.
Then add this content under
config vpn certificate local
edit "CERTNAME"
set certificate "-----BEGIN CERTIFICATE-----
***************************************************
-----END CERTIFICATE-----"
next
end
Note that ****** here means content of the certificate
Hope that this helps
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1643 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.