How to import certificate with same subject and issuer field which is not marked as CA

[santonic]

When I try to import such certificate I get "Only self signed CA cert can have identical sub and issuer fields" error.

The certificate is not from CA server so I don't have "Back up CA" option as described here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NUhCAM

I'm aware of this discussion but it's for SAML and it doesn't give answer to basic question as stated in this sbject:

https://live.paloaltonetworks.com/t5/general-topics/quot-only-self-signed-ca-cert-can-have-identical...

So how can I import a certificate with same subject and issuer field but is not marked as CA? It's a self signed certificate from MS Exchange server which is required for decryption. 

[S.Cantwell]

Good Day!

For decryption, it is needed both the public AND the private key. 

For a Windows server, I did a quick search and these seem like the correct steps:

https://community.tenable.com/s/article/Export-a-Windows-Certificate-with-the-Private-Key

Once you export the certificate with private key (probably PKCS#12), you can then import the certificate in its entirety.

[santonic]

Yes, I know I need private key for decryption. But this isn't the issue here.

The issue is how to import a certificate which has the same subject and issuer field but is not marked as CA? 

[santonic]

So nobody ever tried nor succeeded in this? 

[S.Cantwell]

Hello again.  You may certainly open a PANW TAC case to see what they suggest.  In my experience, I have not been successful in importing a self-signed cert. 

[TomYoung]

Hi @santonic ,

That is a great question.  I assume you are doing Inbound SSL Decryption and the cert is for the inbound Exchange server.  I did not know the NGFW would not import self-signed certs that were not a CA.  Could you please let us know the resolution from TAC?

Thanks,

Tom