Saucepan

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
======Set Custom SSL Certificate======
If you have a Cisco device, you may have issues getting the SSL certificate to work properly on the web GUI.

The solution is [[https://severehalestorm.net/?p=54.%C2%A0|here]].

Specifically, I generated a certificate/key on a Palo Alto Networks PA-220 firewall because that was where I stored my home root CA. I then exported the certificate and ticked 'export private key'. I added a password as PAN-OS does not give you a choice.

Don't forget, it has to be 2048 length key. Not 4096.

Remember, with Cisco, we need three things
  - The certificate
  - The public key
  - The private key

On the Palo Alto Networks firewall, we can generate a certificate with a key that is signed by a root CA. Once you have done that, export it in PEM format with a password.


=====Get the Certificate=====
You can get a copy of just the certificate by opening up the PEM file and copying out this bit to another file.
<code>-----BEGIN CERTIFICATE-----
MII
...
Q==
-----END CERTIFICATE-----</code>
=====Get the Public Key=====
Take the exported PEM file from PAN-OS and put on a machine that has openssl and use the following command to extract the public key
<code>openssl x509 -pubkey -noout -in cert.pem  > pubkey.pem</code>
Then, change
<code>-----BEGIN PUBLIC KEY-----</code>
to
<code>-----BEGIN RSA PUBLIC KEY-----</code>
and
<code>-----END PUBLIC KEY-----</code>
to
<code>-----END RSA PUBLIC KEY-----</code>
Also, remove the first 32 characters of the public key. <code>MIIBCgKCAQEAo5Q21pIa/5C2IXIgQw9Z</code>
**Make sure you adjust the lines so they are the same length as before.**
=====Get the Private Key=====
Strip the password off the certificate key
<code>openssl rsa -in cert.pem -out privkey.pem</code>
Ensure formating is correct.

<code>openssl rsa -in privkey.pem -outform pem > privkey_fixed.pem</code>
=====Install=====
And there you go. Make sure you tell the GUI that the key is not encrypted.

You will need to switch to advanced mode in IOS GUI to see

You will need to provide the following
  - The certificate
  - The public key
  - The private key