topic Re: How to import certificate with same subject and issuer field which is not marked as CA in General Topics

How to import certificate with same subject and issuer field which is not marked as CA

santonic — Tue, 08 Nov 2022 13:45:38 GMT

When I try to import such certificate I get "Only self signed CA cert can have identical sub and issuer fields" error.

The certificate is not from CA server so I don't have "Back up CA" option as described here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NUhCAM

I'm aware of this discussion but it's for SAML and it doesn't give answer to basic question as stated in this sbject:

https://live.paloaltonetworks.com/t5/general-topics/quot-only-self-signed-ca-cert-can-have-identical-sub-and-issuer/td-p/276749

So how can I import a certificate with same subject and issuer field but is not marked as CA? It's a self signed certificate from MS Exchange server which is required for decryption.

Re: How to import certificate with same subject and issuer field which is not marked as CA

S.Cantwell — Tue, 08 Nov 2022 14:10:46 GMT

Good Day!

For decryption, it is needed both the public AND the private key.

For a Windows server, I did a quick search and these seem like the correct steps:

https://community.tenable.com/s/article/Export-a-Windows-Certificate-with-the-Private-Key

Once you export the certificate with private key (probably PKCS#12), you can then import the certificate in its entirety.

Re: How to import certificate with same subject and issuer field which is not marked as CA

santonic — Tue, 08 Nov 2022 17:15:51 GMT

Yes, I know I need private key for decryption. But this isn't the issue here.

The issue is how to import a certificate which has the same subject and issuer field but is not marked as CA?

Re: How to import certificate with same subject and issuer field which is not marked as CA

santonic — Fri, 11 Nov 2022 07:53:07 GMT

So nobody ever tried nor succeeded in this?

Re: How to import certificate with same subject and issuer field which is not marked as CA

S.Cantwell — Fri, 11 Nov 2022 14:55:19 GMT

Hello again. You may certainly open a PANW TAC case to see what they suggest. In my experience, I have not been successful in importing a self-signed cert.

Re: How to import certificate with same subject and issuer field which is not marked as CA

TomYoung — Fri, 11 Nov 2022 15:22:25 GMT

Hi @santonic ,

That is a great question. I assume you are doing Inbound SSL Decryption and the cert is for the inbound Exchange server. I did not know the NGFW would not import self-signed certs that were not a CA. Could you please let us know the resolution from TAC?

Thanks,

Tom