Adding a SSL Certificate (e.g. for the User Portal) does not work.

Question

Hello. I would like to install a SSL Certificate for my User Portal to avoid a Certificate Warning in the Browser by accessing the User Portal via Internet (https). 
 I already know this Tutorial: 
 https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/tasks/CertificatesSigningRequestGenerate.html 
 I would like to access the Portal from this url (example): https://firewall.domain.de:4442 
 Followings Steps i did: 
 I'm generating a CSR (like this example): 
 
 Do i have to receive an E-Mail with using the Certificate ID as E-Mail Type? I did not receive an E-Mail by the way. 
 
 Then I use the CSR to order a Comodo PositiveSSL Certificate. 
 
 After i received the PEM File from Comodo i would like to import the Cert. 
 I choose "Import" on the CSR and then choose the PEM File as "only Certificate" and Import it.

After the import i see the message, that the certficate is not valid or installed. 
 
 I can edit the Certficate and choose the PEM File once again. By the Way, I don't have a Privat Key yet. Do i need the private Key? If yes, how do i generate/receive the private Key? 
 
 When i save the Certficate-Informations then the Certificate will still remain invalid. 
 Maybe someone has an advice, whats wrong or missing? Thanks alot! 
 
 BTW.: I am using a fresh installed, registered XG Version 18.0.5 MR-5

FormerMember · Answer

Hi Markus Schneider , 
 Thank you for reaching out to Sophos Community. 
 Did you try to import ' Sectigo RSA Domain Validation Secure Server CA' under certificate authorities? 
 Knowledge: How to Download & Install Sectigo Intermediate Certificates - RSA

LuCar Toni · Answer

You do not need a private key for a CSR. CAs can generate all information with the CSR provided by the XG. There is no need to export the private key on this step. 
 https://www.globalsign.com/en/blog/what-is-a-certificate-signing-request-csr

LuCar Toni · Answer

Oh, you are right, missed the concept in the new one. 
 
 In MR5 and above, you have the CSR: 
 There is a option to download the CSR as PEM (or text). We killed the option to download the private key, as the private key is stored by the XG and actually does not have to leave the appliance for whatever reason. 
 If you got your PEM by the CA, you need to press the option on the left called "import".

It will give you the option to import the signed certificate based on this CSR. 
 If you upload the PEM to the appliance via the normal process of "Add certificate" it will not match to the CSR.

Adding a SSL Certificate (e.g. for the User Portal) does not work.

Top Replies