topic Re: Creating New Cert from local trusted root CA in General Topics

Creating New Cert from local trusted root CA

MP18 — Wed, 06 Feb 2019 20:34:57 GMT

i have local trusted root CA on the PA.

Also i have ssl decryption cert on the PA.

Is it possible i can create new cert from root and use it for web gui?

Re: Creating New Cert from local trusted root CA

Abdul_Razaq — Thu, 07 Feb 2019 08:38:12 GMT

You can generate a new certificate for GUI as well, but you need not to. you can use the same root cert for GUI as well. call it under ssl/tls service profile. use it under management configuration.

Re: Creating New Cert from local trusted root CA

MP18 — Thu, 07 Feb 2019 12:55:46 GMT

it do not work.

under ssl/tls profile the CA root ceret does not show up?

Re: Creating New Cert from local trusted root CA

Abdul_Razaq — Thu, 07 Feb 2019 13:54:02 GMT

Do you have private key of same certificate inside PA ? . then only you can use the certificate for web access

Re: Creating New Cert from local trusted root CA

MP18 — Fri, 08 Feb 2019 03:39:39 GMT

No CA root cert has no private key checked.

Re: Creating New Cert from local trusted root CA

MP18 — Fri, 15 Feb 2019 21:09:32 GMT

any one can answer this?

Re: Creating New Cert from local trusted root CA

gwesson — Fri, 15 Feb 2019 22:04:48 GMT

Abdul eluded to it - you can't generate a new cert from that root without the private key. If that was a thing you could do, you could just grab GoDaddy or Letsencrypt's public root cert and create a valid cert for any domain. It's a fundamental part of PKI - ff you don't have the private key, you can't sign a new cert issued by that CA.

Re: Creating New Cert from local trusted root CA

MP18 — Fri, 15 Feb 2019 22:23:44 GMT

Many thanks for answering the question.

Re: Creating New Cert from local trusted root CA

Remo — Sat, 16 Feb 2019 13:13:35 GMT

Besides the fact that the whole trust system of the PKI wouln't work if everyone could sign certs with a publoc key, the money-making machine of the public CA also wouln't work 😉