Renew SSL Certificate Error

[TheOnlyJames]

I have searched high and low, but cannot get a clear answer on this, created a CSR last year for a Fortigate, got it signed by ROOT CA, installed cert and used it for SSL VPN, no problem at all. Now its renewal time, got the new cert from the signing authority GODADDY, and I cant install it? 

I have the ROOT CA cert on there, so I goto Certificates > import > Certificate > Local certificate, select my .cer file

and I get this "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL.cert"  I assumed I would delete the old one and replace with this one, same issue? any help please? the troubleshooting link for this error is not helpful, I really dont understand why it doesnt work

Thanks

[TheOnlyJames]

there is no option to "set certificate" 

set ?

password

comments

*private-key

range

source

source-ip

[pminarik]

What you pasted here is typical when creating a new certificate object from scratch. (it is not possible to set the certificate value before setting the private-key.

So it seems like you either intentionally tried creating a new certificate object, or mistyped the existing one's name, thus accidentally ended up in a state where a new one is being created.

[TheOnlyJames]

I was sent the new Cert by the CA, this is why I am confused, I havent asked or done anything, they said "here is your new cert that is about to expire" I uploaded it ready to swap over, then the errors. I dont have the private key, never did, it was just a CSR, then signed, then the cert sent to me

[pminarik · Accepted solution]

My reading of your original post is that you started by creating a CSR on the FortiGate. This generates two "things": the CSR itself, and a matching private key.

When you the uploaded the signed certificate for the first time, it was matched to the private key. So now you should have the private key and the "old" certificate as an object in "config vpn certificate local", unless you deleted it already.

Assuming you haven't sent any new CSR to your CA, that implies that the new certificate they provided you still matches to the "old" private key. So the goal is to have the old privkey + new certificate in a single object in the FortiGate configuration.

That can be achieved by one of the two methods I described in my other reply:

1, Manually edit the old/existing object, and replace the old "set certificate" value with the new one.

2, Upload the privkey and the new certificate as a new object. For that you will need to export the private key out of the configiration, which can only be done if you know the password for the private key. (if you set the password manually during CSR generation and still remember it, you can; otherwise it is not possible)

2b, (alternative) Copy the entrire CLI content of the existing object, edit it in an editor, then paste it in as a new object:
- show full vpn certificate local <old-cert-object-name>

- copy that into a text editor (notepad, notepad++, etc.)

- change the name (edit "oldname" -> edit "newname")

- update the 'set certificate "xxxxx"' content, replace it with the new certificate.

- copy the entire modified snippet and paste it into FortiOS CLI.

-> this should create a new certificate object with the new certificate and the old private key (without having to know the password).

[hbac]

Hi @TheOnlyJames,

Which firmware version are you using? Please try to follow this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-update-a-local-certificate-installe...

Regards, 

[pminarik]

It isn't possible to update an existing certificate object through the GUI. You have two options:

1, (if you have the private key) Upload it again as a new object (using the new certificate and old key), then gradually switch the configs to the new object.

2, Edit the existing certificate object it in the CLI and update the certificate value there.

[adimailig]

When uploading the certificate to Fortigate you need Private Key and Certificate details.
Normally with GoDaddy, it will only provide you with Certificate which is causing issue.
Since this is renewal, what you can do is to update the certificate using CLI.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-update-a-local-certificate-installe...

Or if you want it via GUI, you need to ask GODaddy for the private key.

[TheOnlyJames]

Thank you everyone, your suggestions all seem to explain why this is happening and how to resolve, in this instance, I am creating a new CSR to be signed. Many thanks all