Renew SSL Certificate Error

[TheOnlyJames]

I have searched high and low, but cannot get a clear answer on this, created a CSR last year for a Fortigate, got it signed by ROOT CA, installed cert and used it for SSL VPN, no problem at all. Now its renewal time, got the new cert from the signing authority GODADDY, and I cant install it? 

I have the ROOT CA cert on there, so I goto Certificates > import > Certificate > Local certificate, select my .cer file

and I get this "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL.cert"  I assumed I would delete the old one and replace with this one, same issue? any help please? the troubleshooting link for this error is not helpful, I really dont understand why it doesnt work

Thanks

[ashishrathee]

Team, 

You can check this article that might help you with this: 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Fixing-the-error-Certificate-file-is...

[TheOnlyJames]

That's the article I am referring too, it isn't helpful to my problem. I have the .CRT file, that's all I need , as I have the root already installed.

[ebilcari]

The new certificate will need a new private key, it can't use the old/existing private key even though it may come from the same root CA.

You need to create a new CSR or import the new certificate together with the new private key.

[TheOnlyJames]

Thats a strange way to do it? I have the new cert, where can I get the private key from then?

[ebilcari]

This is pretty standard for every vendor or PKI implementation. The certificate without a private key can not be used. There are some certificate formats that include the private key in the file like PKCS #12 that appear as files with extensions '.pfx' or '.p12', certificate files '.cer' or '.crt' doesn't contain a private key.
Note, the extensions are just as reference and usually not important to the actual content.

If the certificate request is generated by FGT as a CSR, you will not need a private key and it will not be created by the CA, it will be calculated locally in FGT.

[TheOnlyJames]

So it needs a new CSR every time in needs renewing? that doesn't sound right to me, Can I not get the ROOT Authority to give me the PKCS12 file? 

[ebilcari]

Yes, usually public CAs will offer different formats in a bundle ready to import for Apache or IIS/Exchange. The later one will be a single .pfx file (PKCS #12) and password protected.

[TheOnlyJames]

well, thats the first time ever, I have had to create a new CSR on a yearly renewal, I dont use password protection, all I want is a cert file, I have created a new CSR ready to ne signed, I cant do it now, as the provider revokes the old certificate! very very convulted way to do this, in the past, I have just asked for a new .crt and it gets sent to me! as the Fortigate is the same device, no new CSR needed.

[xshkurti]

@TheOnlyJames 
You may try to add certificate content via cli

Open your new certificate crt with a notepad, and copy all content.

Then add this content under 
config vpn certificate local
    edit "CERTNAME"
     set certificate "-----BEGIN CERTIFICATE-----

***************************************************
-----END CERTIFICATE-----"

next

end

Note that ****** here means content of the certificate

Hope that this helps