Certificate on port 443 and 4433

Answers

• BWC Cybersecurity Overlord ✭✭✭

  January 8

  @shwazh if the certificate is issued by a public CA (like Sectigo, etc.) most likely you did not imported the intermediate certificates as well. The whole certificate chain needs to be available to the firewall, otherwise only the cert will be treated as self signed, because the signer is unknown.

  —Michael@BWC

  0
• shwazh Newbie ✭

  January 8

  Hi @BWC,

  Any article or steps for the same?

  0
• BWC Cybersecurity Overlord ✭✭✭

  January 8

  Have a look over here, this should give you an impression.

  https://www.sonicwall.com/support/knowledge-base/imported-certificates-not-validating/170504637875973

  —Michael@BWC

  0
• shwazh Newbie ✭

  January 9

  Hi @BWC

  I have followed all the steps but it is not working.

  0
• MAK Newbie ✭

  January 9

  Could you confirm the source of the CSR? Was it generated on the firewall, or was it created externally?

  0
• shwazh Newbie ✭

  January 10

  It was created externally

  0
• BWC Cybersecurity Overlord ✭✭✭

  January 10

  @shwazh you don't have the intermediate certs imports, this is why it fails (probably).

  Just google for something like this: "openssl create pfx from pem with chain" … you need all the intermediate certs (for the Sub CAs), your server cert and the private key.

  There are even tools around if you don't like to tinker with the command line. Look for XCA, which is IMHO by far the best fantastic stunning and terrific tool for that. More passion for a product you cannot squeeze out of a German, which should tell you how much I like it.

  —Michael@BWC

  0
• MAK Newbie ✭

  January 10

  @shwazh , if you have created the CSR externally then you have two options. Loading only the intermediate and/or the root certificates will not work, since you created the CSR externally and hence the private key is unknown to the firewall. Keep in mind, certificates are based on private-public key encryption concept.

  1. PFX Certificate: This will have the private key and the signed certificate.
  2. P12 Certificate: This will have the private key, and the signed certificate chain.

  You can use OpenSSL or PowerShell to create those files, and other third party tools may be available to do the same job. OpenSSL is very common and you can install it on Windows hosts. As a matter of fact it is probably the most common package used on any device. SonicWall firewalls and other devices such as SMA are utilizing OpenSSL. For PowerShell there is a "certutil" command available and you have to search how to use it. Here are the OpenSSL commands you need to utilize.

  PFX Certificate:

  openssl pkcs12 -export -out your-domain.pfx -inkey your-private-key.key -in your-signed-certificate.crt

  P12 Certificate:

  openssl pkcs12 -export -out your-domain.p12 -inkey your-private-key.pem -in fullchain-certificate.pem

  The CA Authority provides you the "fullchain-certificate.pem" file (file name may be different obviously), which is basically the signed certificate, intermediate , and root certificates in a single encoded file.

  Once you have one of those files (your-domain.pfx or your-domain.p12) available, you can upload it to your firewall and then select the certificate for firewall management or SSLVPN service. When you utilize the P12 certificate, you don't need to upload any intermediate/root certificate on the firewall. This may not be the case for PFX certificate. If the root/intermediate certificate of the signed certificate is not already available on the firewall, then you need to upload them.

  I hope this gives you some insight.

  0