SSLVPN Certificate Parse Error

[fritzikus1302]

Hello Guys,

i want to renew my certificate for ssl vpn over ssh. it worked but now i get the error "Input is not a valid/matched certificate. node_check_object fail! for certificate".

Can someone help me pls. I've post the log from my ssh commands.

Thanks

[boneyard]

you need to import a certificate and key to be able to use it as SSLVPN server cert.

do you have a .p12 of .pfx file for this?

or did you use the same key to generate this new cert?

EDIT please dont share the certificate + key if you post a reply, it probably is password protected but still, rather keep that save.

[nikriaz]

Exactly the same problem. Were you able to figure it out?

[Toshi_Esumi]

If you get only a renewed cert and you don't have private key (included in the PKCS#12(PFX) file) and the password you used to generate it originally, you have to do this CLI method to preserve the encrypted private key while swapping the cert to the new one.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-a-new-local-certificate-afte...

Toshi

[nikriaz]

Thank you for reply.

I see this article and I confirm that this error text with error number "-651" means no matching certificate for the existing key. When I try to renew certificate only for the same, existed key, as described in the article above, it DOES work. However, it is not real-world scenario. Typically renewed certs come with new key.

I found another article:
https://community.fortinet.com/t5/FortiGate/Technical-Note-Upload-Certificate-using-PEM-format/ta-p/...

Whatever I try I always get an error "Invalid private key, password may be required" when I try to upload new key, whether the PEM is encrypted with password or not. "set password" does not work either. The article just suggests "In such cases try getting a new key from the certificate authority and reupload." but this explain nothing unfortunately. 

The question is whether it is possible at all to update existing certificate in-place with new key or not?

UPDATE: I finally found proper format for a key which is PKCS#8 with no password and now it works. Certificate gets in-place renewed with new key. Version is 7.6.3.

[Toshi_Esumi]

If you got a new cert with a new private key, that's a completely new certificate set. You just need to import it as a new one. It doesn't matter the current one exist or not. 
I never tried PEM installation. Try create PKCS#12 format file based on those unencrypted cert+key. There are multiple tools available. But I think the most common one is OpenSSL on Linux. Just make sure you save the password you used to encrypt to a safe and foundable place.

Toshi

[nikriaz]

As I mentioned above, it isn't correct. New cert and with new key can be successfully updated in-place. 

[Toshi_Esumi]

After the second thought, if the certificate name is the same, it would fail.
You probably need to remove existing one first to import the new one. 
To do that, you need to use another one like the factory default one temporarily as a place holder. Otherwise, you wouldn't be able to delete an used cert.

That's another reason I keep doing the first KB method to just swap the cert withouth chainging the private key.

Toshi 

[nikriaz]

No need to remove existed one, no need to change references. Certificate successfully updated in-place with new key.

[mattewwade06]

I’ve run into a similar issue before, and in my case it turned out the certificate format wasn’t right. When you renew it over SSH, make sure both the cert and key are in PEM format, and don’t forget to include the intermediate CA if needed. This Fortinet article explains the process step by step and might help clear the error:
https://community.fortinet.com/t5/FortiGate/Read moreTechnical-Note-Upload-Certificate-using-PEM-format/ta-p/197317