XG 16.05 GA How to extract Appliance certificate please ?

Question

Hello, 
 1. I would like to export the SSL certificate to publish at our own website. Could you please help because I cannot find it. 
 2. Please add the certificate to the user portal in XG, like it is in UTM. Would make my life a lot easier with mobile users. 
 Thanks ! 
 Koen

DouglasFoster · Accepted Answer

I have been digging further. These are my results. 
 1) The appliance certificate has a root that is different from either the DEFAULT or SOPHOS_SSL roots. It is not visible in the Admin console CA list. It is included in the download chain, which is good and bad. This allows it to be extracted (On Windows: Connect with a browser that allows you to ignore errors, then view the certificate, then navigating up the certification chain, then use the Details tab and save to a file.) Once downloaded, it can be loaded as a trusted third-party root certificate. 
 2) However, the root certificate is not supposed to be included in a server's certificate chain, it is supposed to be pre-installed on the client for use to validate the certificate chain. Most browsers ignore this error, but Microsoft Edge will not connect to the appliance as a result.

Michael Dunn · Answer

On the main menu bar on the left, click "Certificates". The certificate for the WebAdmin and Portal is there. You could also change it to your own self signed or valid purchased certificate. 
 The Certificate Authority used for HTTPS scanning is on the Certificate Authority tab. By default, it is the one called SecurityAppliance _SSL_CA, however you can upload your own. Within the Web configuration you can select it to be used. 
 
 I don't know too much about the user portal, but there are various things where you can put in your own HTML or custom messages. Maybe you can override it to include a link to the certificate?