05-03-2012 02:48 PM
Hi Kal,
If the certificate is in .crt format, that means its already in PEM format. PEM certificates usually have extensions such as .pem and .crt. Since its in .crt, I beleive you only have the certificate and not its associated key. You can confirm by opening the .crt file in notepad. If you only see characters dilineated by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----, that means that this is just the certificate. To import PEM format certificate, we require the associated key file also. Normally the certificate and its key are both in the same file in .pem certificates. The key part is dilineated by ------BEGIN RSA PRIVATE KEY----- and ------END RSA PRIVATE KEY-----.
Here is what you need to do:
- Go back to the IIS server and re-export the certificate in .pfx format (pkcs12)
You now have 2 options.
1. Import the .pfx file as it is into PAN by chossing the pkcs12 format during import.
2. Convert the .pfx into .pem and then import the .pem certificate onto PAN. The following doument describes option 2 towards the end of the document:
https://live.paloaltonetworks.com/docs/DOC-1223
Thanks,
Ahsan
