For FPR 1010 SSL VPN setup, How to generate CSR request for Trusted CA

[hiren.bhalala]

For FPR 1010 SSL VPN setup, How to generate CSR request for Trusted CA

[Rob Ingram]

@hiren.bhalala are you using FDM or FMC for management of the FTD?

Here is the guide for FMC

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html

For FDM just go to Objects > Certificates > Add Internal Certificate to create a self signed certificate.

[hiren.bhalala]

I'm using FDM. I tried to use internal certificate. But when I'm connecting to VPN from anyconnect client, it's giving me the certificate error to accept risk. SO that's why I'm planning to get SSL certificate from trusted CA. Abd for that, CA is asking me to create a CSR request from cisco.

[Rob Ingram · Accepted solution]

@hiren.bhalala ok understand. There is no option to create a CSR in the FDM, even in version 7.1. You would need to use openssl to generate the CSR and private key, get the CSR signed by the public CA, then import (with the private key).

• Login to the CLI of the FTD
  
• Type expert to enter expert mode
  
• Type openssl genrsa -out FTD.key 2048 to generate a private key
  
• Type openssl req -new -key FTD.key -out FTD.csr to create a CSR file

[hiren.bhalala]

I followed all the step you provided and it worked with sudo command. Now can you tell me if possible please, how can I get that CSR file from firewall?

[Rob Ingram]

@hiren.bhalala use scp to copy the csr and private key off

scp -r FILENAME username@ipaddress:/

[hiren.bhalala]

Thanks for you help. I successflly created the csr request and I just open the file using the CAT command in cico firewall and then I did copy-paste. Thanks again.

[balaji.bandi]

check below link :

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-certificates.html