Certificate Installation Process?

Jens,

once you have created the CSR you have to upload the content on an online CA which will generate the Certificate and the private key. Did you do that?

See, for example, the buttom of this page: https://support.comodo.com/index.php?/Knowledgebase/Article/View/1/19/csr-generation-using-openssl-apache-wmod_ssl-nginx-os-x

Hi Luk,

Yes, I did that.

The screen I am showing comes up after uploading the actual certificate and private key received from the provider.

Thanks,

Jens

I will send you a PM if you want I will help you on checking the certificate. The certificate must be analyzed but you should not share it publically.

Hi Luk,

Yes, that would be great, but I have too much work this afternoon. Can we wait till tomorrow?

No urgent need on my end. I am just going through all the areas in XG to see what's working and what isn't.

Cheers,

Jens

I have this same issue.  Could you do the same for me and inspect my certificate?

Ok Tom.

I will send you a PM.

Hi Luk and Tom,

Did you have any luck getting this to work?

Cheers,

Jens

Jens,

to make sure you can generate and use a third-party signed Certificate do the following:

1. Generate the Certificate Sign Request (CRS) on XG under System > Certificate > Certificates
2. Upload the generated CSR to public CA (in this case Comodo)
3. Once the Certificate is signed from CA, you will receive a .crt convert the .crt to PEM or .p12 using openssl or any other tool (google it or guillaumemaka.com/.../install-your-comodo-certificates-to-amazon-aws.html)
4. You will receive also the CA Trusted Root CA. Upload it inside the Certificate Authorities on XG
5. Import the Certificate .pem inside Certificate TAB on XG
6. Import the private key and digit the passphrase
7. Done

Remember to import first the CA and then all the certificates signed by that CA.

Hi Luk,

This worked!

I basically didn't upload the CA Trusted Root CA because it appeared to be already there. Once I did, I had to upload my new certificate once more and it started working!

Thank you for your help!

Cheers,

Jens

Unfortunately, the recommended solution didn't help in my case (although a solid response to the question), as RapidSSL would not accept the XG CSR.

So for the unfortunate soul, who runs across this thread.

The following worked for me:

https://www.ipinfosec.com/add-godaddy-ssl-certificate-sophos-xg-firewall/

In a nutshell, on a spare Linux box:

1) openssl req -new -newkey rsa:2048 -nodes -keyout YOURCOMPANY.com.key -out YOURCOMPANY.com.csr

2) Grab the csr and key files

3) Submit the CSR to the CA (RapidSSL in our case)

4) Add the p7b (or what valid format the your CA gives you) and the key (from the Linux box) files to the XG key store

So far, tested the User Portal and VPN without issues.

Paul

XG Certified Administrator