SSL inbound inspection certificate issue

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL inbound inspection certificate issue

L1 Bithead

I am trying to configure SSL inbound inspection for one of the application in our environment. I am not sure if the certificates that are being provided are correct and need some guidance for the same.


Steps done:


> Server team generated CSR in pkcs12 format and sent the same to our companies internal CA for signing. 

> Certs provided to me and server team in .p7b format to import.

> import on the server is successful

> Importing on the firewall the cert format wasn't supported, so i converted it to PEM format.

> But after importing the cert i am not see the key being imported on to the firewall its just a security certificate.

> I doubt SSl inspection will work without firewall having the key to decrypt the packets.



Is the above process of generating the cert is correct? 

Do we need key to be imported on the firewall for SSL inspection to work or can certificate alone will be able to make it work?

it will be great if anyone can share step by step process including the type of cert that to be generated from the server?


Thanks in advance!



Cyber Elite
Cyber Elite

were you able to convert the private key as well? if you open the PEM file, you should see 2 (start/end) certificate blocks inside. one will be the cert, the other the private key. 

when importing, make sure to check 'import private key' and add the pem file to the private key file as well and add the passphrase used.

if the p7b was delivered without a password, you may neet do import it onto a server first, and then export including the private key AND a password (can't import private key without password)


ssl decryption will not work without the private key

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!