Certificate manager and generating public keys

[Derelict]

Yeah, and there's an export private key so not sure why you dorked with extracting the key from the pkcs12 bundle but glad it's working. :)

[stats2909]

I was halfway though that when I noticed that accessing the gui via the IP gave a green url bar.

AS I couldn't really tell if I'd signed things properly - the switch was hardly forthcoming with info I checked the certificate the browser was seeing.

It turned out to be the one I'd created at the outset of the process… so felt I'd give that one final go starting fresh before going down the signing route.

(which i think would have been easiest all along lol)

Thanks again :)

[stats2909]

@Derelict:

Yeah, and there's an export private key so not sure why you dorked with extracting the key from the pkcs12 bundle but glad it's working. :)

Pass…. Something about seeing the wood for the trees comes to mind, that and not really knowing what I'm doing!  ::)

[4o4rh]

sorry guys, can someone summarize the idiot proof version of these instructions please.

• i have created Root CA and Sub-Root CA
• I have created Server Certificates with the Sub-Root CA
• i have successfully set these up with openwrt & freenas devices
• i am struggling to get them working on my two netgear switches.

[4o4rh]

@gwaitsi as I had to do this again, and completely forgot how I did this last time, here are the instructions for 2021.

1. Save the device cert & key generated in pfsense locally

2. rename the device.crt to root.pem

3. convert the private key to rsa private key
   openssl rsa -in device.key -out device_rsa.key

4. create a file called ssl_key.pem
   a) copy the contents of device.crt into this file from
   -----BEGIN CERTIFICATE-----
   MIIE2jCCA8KgAwIBAgIBHjAN.......
   i1M5xmyTK0cyhwQ==
   -----END CERTIFICATE-----
   b) copy the contents of device_rsa.key into this file below the certificate from
   -----BEGIN RSA PRIVATE KEY-----
   MIIE.....
   ZBjv7j74PS4P7I=
   -----END RSA PRIVATE KEY-----

5. From the netgear switch "Maintenance", "Update", "HTTP Firmware/File Update" select

   • "X.509 Public Certificate PEM" and load the root.pem
   • "X.509 Certificate Private Key PEM" and load the ssl_key.pem

6. From the netgear switch "Security", "Access", "HTTPS", "Admin Mode" - Enable.