cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Create CSR and Importing third party certificate in Mobile Access Blade

Hi All,

This is about Creating CSR and importing third party certificate to gateway for Mobile Access Blade. We have already SK69660 but adding snapshot for better idea.

First generate Request to generate certificate (CSR) with below command.

cpopenssl req -new -out <CERT.CSR> -keyout <KEYFILE.KEY> -config $CPDIR/conf/openssl.cnf

Then you can send this *.csr file to third party so that they can create certificate for you.

Third party will give you combined certificate where 3 certificates (Primary SSL, Intermediate & Root) will resides or separate certificates. If you receive separate certificates then you need to combine all certificates in Text Editor as suggested in sk69660. Please make combined file in *.crt format.

Now the final stage is to import certificate in Firewall but before that we need to convert this certificate ext from *.crt to *.P12 You need to use below command for conversion.

cpopenssl pkcs12 -export -out <New file name as P12> -in <Your combined certificate> -inkey <Private key which is generated during CSR>

 

Now this *.P12 file you need to import in Gateway --> Properties --> Mobile Access --> Portal Setting --> Import the file.

Save & Push policy.

Now when you connect sslvpn (https://Gateway_IP/sslvpn), you will not get any certificate error and you can see certificate that is provided by third party.

11 Replies

Re: Create CSR and Importing third party certificate in Mobile Access Blade

I am getting a pop up to key-in password, but I didn't set any password on .p12 file. Any idea please?

0 Kudos

Re: Create CSR and Importing third party certificate in Mobile Access Blade

I have kept password. If you didn't set password then just keep it blank and enter, it fails then I think you can regenerate the .p12 and keep password.

0 Kudos

Re: Create CSR and Importing third party certificate in Mobile Access Blade

Thanks for the reply, I had tried that too. Received the same "password is incorrect" error regardless the certificate is with or without password.

0 Kudos

Re: Create CSR and Importing third party certificate in Mobile Access Blade

Hmm. Strange.

Re: Create CSR and Importing third party certificate in Mobile Access Blade

I've managed to make it work with a workaround. Export the .P12 cert using openssl on windows server and import to CP gateway.

CP tech support is still checking why the cert exported from security gateway is not working.

0 Kudos

Re: Create CSR and Importing third party certificate in Mobile Access Blade

Ok. Please let us know whatever the result is.

Re: Create CSR and Importing third party certificate in Mobile Access Blade

I had a similar issue importing server certs for https inspection,  i  found that i needed to use the -passin and -passout options with openssl when creating the p12 or else the import always failed with incorrect password 

openssl pkcs12 -export -out  website.p12 -inkey  website.key  -in website.pem  -certfile  ca-chain.pem -passin passSmiley Tonguerivatekeypass  -passout passSmiley Tonguerivatekeypass 

0 Kudos

Re: Create CSR and Importing third party certificate in Mobile Access Blade

Is there any procedure on how to do it on cluster firewalls?

Re: Create CSR and Importing third party certificate in Mobile Access Blade

Hi there, I would like to know the same thing. Did you perhaps managed to get it to work in cluster environment.

0 Kudos
Vladimir
Jade

Re: Create CSR and Importing third party certificate in Mobile Access Blade

I am about to do this in a clustered production environment and will try to remember to update this thread. Of note though is that when generating CSR, I had to include "-newkey rsa:2048" in the command:

"openssl req -new -newkey rsa:2048 -nodes -out gw8010.blablabla.com.rsa.csr -keyout gw8010.blablabla.com.rsa.pkey -subj "/C=US/ST=New Jersey/L=Wayne/O=Higher Intelligence LLC/CN=gw8010.blablabla.com"

Else the CA was complaining.

Vladimir
Jade

Re: Create CSR and Importing third party certificate in Mobile Access Blade

No problem with deployment in the clustered environment.

Just completed it today.

You perform CLI certificate operations on a single cluster member, but import resultant certificate in the SmartConsole in the Cluster Object's properties.