Messaging Gateway cannot install PKCS#12 SSL/TLS certificate

Products

• Messaging Gateway

Issue/Introduction

SSL/TLS certificate in PKCS#12 (.p12 or .pfx) format cannot be installed completely by Symantec Messaging Gateway (SMG) for your scanner.

Environment

Scanner shows "Requested" in certificate list in Control Center.

Cause

The PKCS#12 certificate is not compatible with SMG, and the SMG cannot convert it on its own.

Certificates must be in x509/PEM format in order to be installed into the Messaging Gateway.

Resolution

Notice: These instructions are provided as a service to our customers. Symantec ECS will not provide assistance to convert certificate formats by phone, email, or chat. For more assistance, please contact your certificate authority.

 

Convert the PKCS#12 certificate to x509/.pem file and import:

1. Install OpenSSL (https://www.openssl.org/ for installation help) on the workstation, if not already installed. Most versions of Windows do not have this software.
2. Copy the .pfx/p12 file into the same directory as the OpenSSL executable
3. Run the command openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes
   • certificate.pfx is replaced by the name of the existing cert, and the name for the exported cert replaces certificate.pem (ex. converted_smg_cert.pem).
4. Enter the password used during the creation/export of the .pfx/.p12 file (if applicable).
5. Take the new PEM certificate file, and import into the Control Center of the SMG.

For more information, please refer to the Administration Guide chapter on "Setting up Certificates".