SSL Certificate not showing in Email Protection/Advanced/TLS Settings, but in Certificate list

Question

I have purchased a certificate from Digicert and am trying to get the SMTP proxy to use it for TLS. 
 I've been able to import it into Remote Access/Certificate Management and it appears with the basic details (expiry date, fingerprint, etc). 
 But when I go to Email Protection/Advanced/TLS Settings it is missing from the pop-up list to the right of 'TLS certificate:' 
 The certificate I uploaded was a .pem file with private key, Digicert's root and intermediate certs and the one for my server. 
 How do I get the certificate to show up as a choice in Email Protection? 
 Running version 9.407-3. 
 Thanks, 
 James.

BAlfson · Accepted Answer

James, you will need to create a PKCS#12 that includes the cert and the two CAs. When you import that with Certificate Management, things will work. I know there's a KB article about how to do that. 
 Cheers - Bob

Emile Belcourt · Answer

Hi BAlfson, 
 Are you looking for this one? 
 https://community.sophos.com/kb/en-us/118084 
 Emile

jlbrown · Answer

Thanks Bob & Emile. 
 Got it working. For anyone else who has the same difficulty, this is what I did (see https://community.sophos.com/products/unified-threat-management/f/general-discussion/22147/no-luck-using-a-ssl-certificate-with-webadmin-user-portal/307217#pi2132219853=5 ): 
 
 Get your site certificate and CA certs from the CA. 
 
 Create PKCS12 in OpenSSL: 
 openssl pkcs12 -export -out site.p12 -inkey private.key -in sitecert.crt -certfile cachain.crt 
 sitecert.crt Your site certificate that came from the CA. private.key is the one you created and sent to Digicert with the CSR. 
 cachain.crt: I used the intermediate cert only- DigiCertCA.crt which came with my site cert. 
 
 UTM > Remote Access, Cert Mgmt 
 New Certificate 
 Give it a name, upload, PKCS#12, browse to file, provide password for file, save. 
 You should see your site cert in Certificates and the CA certs in the Certificate Authority tab. 
 
 It then appeared in the list of certs (drop-down menu) in Email Protection/SMTP/Advanced/TLS Settings.