SSL inbound inspection certificate issue

[Sukhmeet]

I am trying to configure SSL inbound inspection for one of the application in our environment. I am not sure if the certificates that are being provided are correct and need some guidance for the same.

Steps done:

> Server team generated CSR in pkcs12 format and sent the same to our companies internal CA for signing. 

> Certs provided to me and server team in .p7b format to import.

> import on the server is successful

> Importing on the firewall the cert format wasn't supported, so i converted it to PEM format.

> But after importing the cert i am not see the key being imported on to the firewall its just a security certificate.

> I doubt SSl inspection will work without firewall having the key to decrypt the packets.

question:

Is the above process of generating the cert is correct? 

Do we need key to be imported on the firewall for SSL inspection to work or can certificate alone will be able to make it work?

it will be great if anyone can share step by step process including the type of cert that to be generated from the server?

Thanks in advance!

[reaper]

were you able to convert the private key as well? if you open the PEM file, you should see 2 (start/end) certificate blocks inside. one will be the cert, the other the private key. 

when importing, make sure to check 'import private key' and add the pem file to the private key file as well and add the passphrase used.

if the p7b was delivered without a password, you may neet do import it onto a server first, and then export including the private key AND a password (can't import private key without password)

ssl decryption will not work without the private key