topic How to reimport a csr via api in General Topics

How to reimport a csr via api

reaper — Mon, 02 Aug 2021 15:57:54 GMT

Anyone ever tried to import a csr back into config?

I generated a csr on panorama the other day and then went to generate a certificate. (I did not commit at this time)

when I came back with the csr response someone had reverted the config so my csr was gone

I now have a config audit entry with some rest API information about the cert car, but can't seem to inject it back into panorama, anyone ever tried this before?

i tried the below, which is probably not right 🙂

/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='MyFirewall']/config/shared/certificate/entry[@name='CertName']/common-name/entry[@name='portal.example.com']/subject/entry[@name='subject=/C=BE/ST=Antwerp/L=Antwerp/O=PANgurus BV/OU=PANgurus BV/CN=portal.example.com']/algorithm/entry[@name='RSA']/csr/entry[@name='-----BEGIN CERTIFICATE REQUEST-----.myCSR.-----END CERTIFICATE REQUEST-----.']&REST_API_TOKEN=xxxx

Re: How to reimport a csr via api

Remo — Mon, 02 Aug 2021 17:13:19 GMT

Hi @reaper

I know this situation (generated a csr and when importing the cert, the initial csr was gone). I then started all over snd generated another csr.

Does it need to be the API for this? If not I think the best chances are there if you take the config of the backup/config version and past this into the current running config : P

Re: How to reimport a csr via api

reaper — Mon, 02 Aug 2021 17:41:28 GMT

Hi @Remo : because I didn't commit, there is no config to roll back to unfortunately. All that's left of the original csr is the entry in the config log, which is rest API

My next attemp might be to try CLI as this is a little more "user friendly" with error messages, but this is in an organization where CLI is pretty hard to obtain 😉

Re: How to reimport a csr via api

Remo — Mon, 02 Aug 2021 17:50:22 GMT

Got it about the config. But if you need exactly this csr, then I still would try to enter this directly to the config xml (export config, paste the csr (maybe create another csr prior to that so you have the configstructure where you could replace the csr) and then import the xml again). Right now you have all the required fields but so far only the wrong format to paste it directly.

Re: How to reimport a csr via api

OtakarKlier — Tue, 03 Aug 2021 21:25:02 GMT

Hello,

Does the CSR get entered into the config.xml file? Perhaps you can grab it from there or put it back into it/

Just thinking out loud.

Regards,

Re: How to reimport a csr via api

reaper — Thu, 05 Aug 2021 17:29:30 GMT

If you don't commit, it doesn't get entered into the config file unfortunately

We've since needed to move forward so created a new csr and got the cert reissued