Adding a SSL Certificate (e.g. for the User Portal) does not work.

Hi Markus Schneider,

Thank you for reaching out to Sophos Community.

Did you try to import 'Sectigo RSA Domain Validation Secure Server CA' under certificate authorities?

Knowledge: How to Download & Install Sectigo Intermediate Certificates - RSA

No i did not. Is this part of the usual process to create a CSR for a SSL Certificate and to import the PEM File/Certificate to the XG?

I generated the CSR in the XG so the XG should be my CA, isnt it? Where do i find the private Key in the CA of the XG or get the key from the XG?

Or what is the easiest way to get a SSL Certificate for the Admin/User Portal?

Hi. According to the manual you should have had the possibility to download the private.key, after you created the CSR.

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/tasks/CertificateSigningRequestGenerate.html

> Download the CSR using the download button.

> The download button is highlighted below.

This changed after V18.0 MR5 due compliance issues. 

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/nsg/tasks/CertificatesSigningRequestGenerate.html

Certificate signing requests (CSRs) and certificates

• Streamlined forms and multiple SANs: Updated the forms for creating CSRs and certificates to allow more flexibility in adding Subject Alternative Names using DNS names and IP addresses, and removed unnecessary inputs.
• Security enhancements: Addressed security concerns by preventing the download of private key material for CSRs and locally-signed certificates.
• Upload, download, import: Provided new dialog boxes to allow CSR retrieval, and certificate upload for signing certificates (CAs) and leaf certificates. The boxes allow you to copy-paste PEM format certificates in addition to the DER, PKCS and PEM file transfer.
• Locally-signed certificates: Self-signed certificates have been renamed locally-signed certificates.
• Download format: CSRs and certificates can be downloaded as .csr and .crt files, respectively. They can't be downloaded as tar.gz files any longer.
• Certificate with CA: Provided the option to add the certificate's CA to the CA list, using the same name when importing certificates with CA.
• Workflow: Improvements to workflows and lists to make certificate management more intuitive.

Thanks Luca. But how the customer is now getting the private key in order to use it on another server?

You do not need a private key for a CSR. CAs can generate all information with the CSR provided by the XG. There is no need to export the private key on this step. 

https://www.globalsign.com/en/blog/what-is-a-certificate-signing-request-csr

Yes, but with the CSR, you get the privat key of the certificate, which you get from your CA.
And then, you want to use this certificate on your internal server, you need the certificate from the CA and the corresponding private key file you generated on CSR creation - right?

There has not been a Key File neither a password if you download the File after creating a CSR. Just the CSR Request Code.
But you dont really need to download that because you can simply copy/paste it.

So how do i find the private Key for that CSR and how do i use it to finally select the generated Certificate for the Portal?

You do not need a private key for a CSR.

You need to figure out, how to download the Key from your CA website. CSR is used to generate a Certificate + Private key. The private key and Cert is provided by your CA and not XG: 

Sorry, but i think you are wrong. The owner of a certificate creates the private key file in csr creation process locally! It would be a very high security risk, if a CA has all the private keys from their customer certificates! 

Oh, you are right, missed the concept in the new one. 

In MR5 and above, you have the CSR: 

There is a option to download the CSR as PEM (or text). We killed the option to download the private key, as the private key is stored by the XG and actually does not have to leave the appliance for whatever reason. 

If you got your PEM by the CA, you need to press the option on the left called "import". 

It will give you the option to import the signed certificate based on this CSR. 

If you upload the PEM to the appliance via the normal process of "Add certificate" it will not match to the CSR. 

Oh, you are right, missed the concept in the new one. 

In MR5 and above, you have the CSR: 

There is a option to download the CSR as PEM (or text). We killed the option to download the private key, as the private key is stored by the XG and actually does not have to leave the appliance for whatever reason. 

If you got your PEM by the CA, you need to press the option on the left called "import". 

It will give you the option to import the signed certificate based on this CSR. 

If you upload the PEM to the appliance via the normal process of "Add certificate" it will not match to the CSR. 

But this is exactly the Way i did it in the first way...

Now i have deleted the Certificate, that was active but that i couldnt see and choose for the Portals
and created a new CSR-Request called "Portal-SSL":

The key file, which is no longer directly downloadable via the Sophos Admin Portal, can be copied via SSH from  the following
path: /conf/certificate/private/portal-ssl.key "

With the new CSR i created/ordered a new Comodo SSL-Certifcate (as PEM File).

By now i have the new PEM-File and the Key File from the XG via SSH/CLI.

But what to do now? Do i Import the Certificate (PEM File) over the CSR Import Function?

If i do it this i can only choose the PEM File but not the Key File.



Or do i rather choose the way to add the Certificate via "Add Certificate"

If i would do so, i could choose the Certificate (PEM File) and the Key File.

Which Name i should choose? The same as the CSR? And which password?

If this is the right way, why is there also an import Option for the CSR (without the Key File). And if the import Process is the right way,
why it didnt work for me?

I am pretty confused...

It should work by uploading the PEM provided by  the CA to the import option. Simply upload the PEM. The Key never leaves the firewall and is not required. The firewall holds the key. 

Okay finally it works! :) Thanks for the help! 

But before importing the Certifcate the 'Sectigo RSA Domain Validation Secure Server CA' has to be downloaded and installed under certificate authorities otherwise my SSL Certicate wont get active, right?