Add externally generated certificate, intermediate and root CAs
You can upload an externally generated intermediate CA with its private key and its root CA.
Note
We recommend using a CSR generated in the firewall to generate the certificates and intermediate CAs.
The firewall automatically matches the CSR's private key with the CA, ensuring private key security. See Add subordinate and root CAs for TLS traffic.
Upload the certificate
- Go to Certificates > Certificates and click Add.
- Enter a name.
- Select the Certificate file format, for example, PEM (.pem).
- Click Browse and upload the Certificate.
- Click Browse and upload the Private key.
- Enter the passphrase or preshared key.
- Click Save.
Upload the intermediate CA
- Go to Certificates > Certificate authorities and click Add.
-
Upload the CA certificate or paste the certificate data.
The firewall automatically detects the certificate format. It supports X.509 certificates in
.pem
,.der
, and.cer
formats. -
(Optional) Change the name.
- In this example, set the CA's purpose to Signing and validation.
- Upload its private key.
- Enter the private key's passphrase.
- Click Save.
Upload the root CA
You must upload the root CA to validate the intermediate CA.
- Go to Certificates > Certificate authorities and click Add.
- Upload the CA certificate or paste the certificate data.
-
Set Use certificate for to Validation only.
It validates the intermediate CA.
-
Click Save.
Check the certificate's trust
- Go to Certificates > Certificates.
- Under Trusted, see if the green check icon appears for the certificate you uploaded.
(Optional) Check the intermediate CA's private key
- Go to Certificates > Certificate authorities.
- Click the filter button next to Type.
-
In the pop-up window, select Uploaded and click Apply.
-
See if the private key icon appears next to the subordinate CA.
It confirms that you've uploaded the signing CA's private key to the firewall.
More resources