SSL wildcard certificate for firewall SAML portal

[Juraj_Skalny]

Hello,

I'm wondering if there is any way how to install a company ssl wildcard certificate for the firewall SAML portal in order to avoid browser security warnings. There is a post where it is indicated this works but there is no how to listed.

Thank you for your help,

Juraj

[PhoneBoy]

Pretty sure this is where you configure it:

[Juraj_Skalny · Accepted solution]

Hello PhoneBoy,

Thank you for the response!

For SAML authentication the certificate is being uploaded here. 

The primary concern was how to introduce a company wildcard already signed certificate (*.domain.com) to the firewall.

I only found  sk69660 describing a procedure starting with CSR and sending it to the 3rd part CA for signing etc.

But there is a way how to bypass CSR and proceed with already signed certificate.

we had a *x509.cer certificate with a *.key (private key) 

first step was to rename *x509.cer to *x509.crt 

make sure that the CRT file has the full certificate chain up to a trusted root CA.

second step was to combine *x509.crt with *.key 

this step is documented in sk69660

[Expert@gw]# cpopenssl pkcs12 -export -out Final_cert_name.p12 -in *x509.crt -inkey *.key

Then the last step is just to upload it to the portal settings according to your picture or the other picture.

All worked like a charm.

Thanks,

Juraj

[PhoneBoy]

Ah, didn't know you were referring to the the SAML portal for Remote Access.
But yes, this makes sense: the cert you import needs to have the full certificate chain included and in the correct format.

[glyaskov]

Hello Juraj and PhoneBoy,

Following this post I was able to successfully import the wildcard certificate of our company *.domain.com. I have a DNS record for vpn.domain.com resolving to the firewall's external IP address. When creating the site I receive the warning message, which I have to Trust, stating that the presented certificate name *.domain.com differs from the site name vpn.domain.com. There is also a security alert appearing everytime the Secure Remote VPN client is started - leading to multiple complains from employees.

When I open the Main URL in a browser https://vpn.domain.com/saml-vpn it redirects to https://<firewal_external_ip>/saml-vpn/Access, which most probably causes the observed security alert.

Is there a way to replace the redirect url without recreating the IDP object?

[glyaskov]

Found the issue. It seems that the MULTIPORTAL_HOSTNAME variable in /opt/CPshrd-R81/conf/multiportal/httpd-conf/saml-vpn/httpd.conf keep the IPv4 address, instead of vpn.domain.com FQDN. The issue was fixed by manually editing the value.