Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Gaurav_Pandya
Advisor

Create CSR and Importing third party certificate in Mobile Access Blade

Hi All,

This is about Creating CSR and importing third party certificate to gateway for Mobile Access Blade. We have already SK69660 but adding snapshot for better idea.

First generate Request to generate certificate (CSR) with below command.

cpopenssl req -new -out <CERT.CSR> -keyout <KEYFILE.KEY> -config $CPDIR/conf/openssl.cnf

Then you can send this *.csr file to third party so that they can create certificate for you.

Third party will give you combined certificate where 3 certificates (Primary SSL, Intermediate & Root) will resides or separate certificates. If you receive separate certificates then you need to combine all certificates in Text Editor as suggested in sk69660. Please make combined file in *.crt format.

Now the final stage is to import certificate in Firewall but before that we need to convert this certificate ext from *.crt to *.P12 You need to use below command for conversion.

cpopenssl pkcs12 -export -out <New file name as P12> -in <Your combined certificate> -inkey <Private key which is generated during CSR>

 

Now this *.P12 file you need to import in Gateway --> Properties --> Mobile Access --> Portal Setting --> Import the file.

Save & Push policy.

Now when you connect sslvpn (https://Gateway_IP/sslvpn), you will not get any certificate error and you can see certificate that is provided by third party.

15 Replies
Zaw_Hein_Aung
Participant

I am getting a pop up to key-in password, but I didn't set any password on .p12 file. Any idea please?

0 Kudos
Gaurav_Pandya
Advisor

I have kept password. If you didn't set password then just keep it blank and enter, it fails then I think you can regenerate the .p12 and keep password.

0 Kudos
Zaw_Hein_Aung
Participant

Thanks for the reply, I had tried that too. Received the same "password is incorrect" error regardless the certificate is with or without password.

0 Kudos
Gaurav_Pandya
Advisor

Hmm. Strange.

Zaw_Hein_Aung
Participant

I've managed to make it work with a workaround. Export the .P12 cert using openssl on windows server and import to CP gateway.

CP tech support is still checking why the cert exported from security gateway is not working.

0 Kudos
Gaurav_Pandya
Advisor

Ok. Please let us know whatever the result is.

Brian_Kirwan
Explorer

I had a similar issue importing server certs for https inspection,  i  found that i needed to use the -passin and -passout options with openssl when creating the p12 or else the import always failed with incorrect password 

openssl pkcs12 -export -out  website.p12 -inkey  website.key  -in website.pem  -certfile  ca-chain.pem -passin pass:privatekeypass  -passout pass:privatekeypass 

0 Kudos
AC1
Explorer

I recently encountered the same problem when importing a certificate - an error message about an incorrect password. I tried different options with openssl and a banal change in the extension of the certificate file from pfx to p12 helped me.

0 Kudos
Alsnator_C
Explorer

Is there any procedure on how to do it on cluster firewalls?

Di_Junior
Advisor
Advisor

Hi there, I would like to know the same thing. Did you perhaps managed to get it to work in cluster environment.

0 Kudos
Vladimir
Champion
Champion

I am about to do this in a clustered production environment and will try to remember to update this thread. Of note though is that when generating CSR, I had to include "-newkey rsa:2048" in the command:

"openssl req -new -newkey rsa:2048 -nodes -out gw8010.blablabla.com.rsa.csr -keyout gw8010.blablabla.com.rsa.pkey -subj "/C=US/ST=New Jersey/L=Wayne/O=Higher Intelligence LLC/CN=gw8010.blablabla.com"

Else the CA was complaining.

Vladimir
Champion
Champion

No problem with deployment in the clustered environment.

Just completed it today.

You perform CLI certificate operations on a single cluster member, but import resultant certificate in the SmartConsole in the Cluster Object's properties.

Ilmo_Anttonen
Collaborator

I started this process last week, creating the CSR and requested the cert. Today when I was going to finish it, I realised that I should have noted the key-file which I used to sign the CSR request. Because I need to re-use that same key now to install the certificate, right?

Question is, what to do if I lost the pw to the .key file?

0 Kudos
Ilmo_Anttonen
Collaborator

The solution was to just create a new csr. 

Now I know I need to save the password for the inkey file.

shantilalSuthar
Participant

Hi,

I am using IPsec for remote access. How do i import the p12 certificate for that ?

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events