Certificate Chain Requirements from External CA for Global Protect

[GP7337]

Hi Everyone,

So I'm having issues configuring my GP as it does not allow me to select the server-cert from the TLS/SSL Service profile Window.

The server-cert is not even an option to select from within the window itself and when i try to import it from inside the TLS/SSL Service profile window - it imports but errors out saying the cert is invalid.

I noticed that the certificate chain I got from SSL.com that I imported doesn't have a check mark on the key column under the server cert, I only have a checkmark under the key column for the root cert which overwrote the CSR.

So the question I have is - how do I get a key check mark to appear under the Server-Cert inside the cert chain?  Do I have the wrong type of SSL cert?  What am I missing?

Thanks in Advance Everyone!

[Naga_Chaturvedi]

As per the image it into firewall along with ROOT-CA cert private key is also imported, but for server/ssl cert only certificate is imported not key, Without private key it wont appear in SSL/TLS profile settings, Reimport the certificate along with private key.  

[GP7337]

Hi Naga,

Thanks for your reply! 🙂

So this is part of the problem I don't have a key for the server cert specifically as the cert I received is part of a certificate bundle.

When I try to import the CSR key that was used to generate the external CA's certificate chain it errors out saying the key isn't valid.

So is there a specific attribute or a type of cert I need in order to get this to work? 

Thanks,

Gary

[GP7337]

Just a heads up this was fixed - when you are importing the certs into the firewall do not overwrite the CSR until you are importing the server cert portion of the certificate chain.  This way the key will be paired properly with the server cert.
Hope this helps someone in the future 🙂