Firebox SSL VPN Gateway Administration Guide - WatchGuard ...

Administering the Firebox SSLThe Firebox SSL accepts a Privacy Enhanced Mail (PEM) formatcertificate file. PEM is a text format that is the Base-64 encodingof the Distinguished Encoding Rules (DER) binary format.The PEM format specifies the use of text BEGIN and END linesthat indicate the type of content that is being encoded.Before you can upload a certificate to the Firebox SSL, you willneed to generate a Certificate Signing Request (CSR) and privatekey. We recommend using Linux OpenSSL to administer anycertificate tasks. If Linux is not available, we recommend theCygwin UNIX environment for Windows, which includes anOpenSSL module. Instructions for downloading, installing, andusing the Cygwin UNIX environment to generate a CSR areincluded in this section.If you are familiar with certificate manipulation, you can useother tools to create a PEM-formatted file. The certificate thatyou upload to the Firebox SSL must have the following characteristics:• It must be in PEM format and must include a private key.• The signed certificate and private key must be unencrypted.The following topics describe how to perform the tasks associatedwith generating a CSR:• “About Digital Certificates and Firebox SSL Operation” onpage 31• “Overview of the Certificate Signing Request” on page 32• “Installing the Cygwin UNIX Environment for Windows” onpage 33• “Generating a CSR” on page 33• “Unencrypting the Private Key” on page 34• “Converting to a PEM-Formatted Certificate” on page 35• “Combining the Private Key with the Signed Certificate” onpage 36• “Generating Trusted Certificates for Multiple Levels” onpage 37• “Uploading a Certificate to the Firebox SSL” on page 3830 Firebox SSL VPN Gateway Administration Guide