FTD Cert Renewal theough FMC

[S891]

Hi there,

Few questions here:

What is the easiest way to renew CA cert on FTD through FMC?

Does it require creating new trustpoint etc?

Is it ok to generate CSR on FMC or should I use OpenSSL? 

Is the format .crt can be imported directly or does it require conversion?

Any other helpful tip or gotchas will be helpful as well.  

[Rob Ingram]

@S891 no you don't need to use openssl to renew, you can click the renew button to generate an csr. Guide here:

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html#anc14

[S891]

Hi Rob,

Thanks for the reply. I am following the  "Manual Certificate Renewal" steps but instead of pop up giving the message "This operation will generate a CSR.." it is giving the message "Re-enrolling the certificate will clear the existing certificate from the device and install the certificate again. Are you sure, you want to re-enroll the certificate?"

[S891]

Still trying to figure this out. I can't find a way to generate CSR for cert renewal through GUI. 

Is that a requirement that these certs on FTDs are to be in PKCS12 format?

Can I generate CSR from any other system and then once cert is received I install in .crt format or if a requirement to be in PKCS12 then convert it accordingly?