certificate for ssl vpn (usg6565e)

Dear friend!
Please rest assured that we'll be back with an answer shortly.

Hello, 

You can refer to the steps to import the certificate https://support.huawei.com/hedex/hdx.do?docid=EDOC1100092598&id=EN-US_TASK_0178922784&lang=en 

Hope to help you!

Hi again!
Thenk you for the link. I was able to import certificate as it shows in this document.

 but in drop-down-menu
i can find only preinstalled certificate

and browser shows thats certificate i use is selfgenerated

Hello friend!
I have checked the relevant cases, and I suspect that you did not import the certificate correctly before. I suggest you delete the uploaded certificate and re-import the certificate according to the correct import method.

Hi jason_hu !

 i tried do this again. and the error i get :

What does this error mean? bad certificate or wrong password to certificate?

Hello,
Untrusted: The SSL decryption certificate is not trusted by the client.
Upon receiving a true server certificate, the FW verifies the certificate. If the true server certificate is illegal (not issued by a trusted CA or is revoked), the FW re-issues a certificate using an untrusted SSL decryption certificate to the client. Because the SSL decryption certificate is not trusted by the client, client applications identify the certificate as illegal. In such a case, an application of the client prompts a security alert, indicating that the server certificate is illegal. Users can release the alert or terminate the access. In this way, the FW correctly delivers the information about the illegal certificate of the server to the client, so that users can learn possible security risks. https://support.huawei.com/hedex/hdx.do?docid=EDOC1100092598&id=EN-US_TOPIC_0184839760&lang=en

It looks like i found what the problem was to the certificate. My certificate is wildcard type. Firewall refused to work with wildcard certif. I made a usual one and it suits to FW.

If you want more information about SSL Certificate so please check here.
https://www.wildcardsslcertificate.com/

In short:

1) As i understand wildcard certificate isnt sutable for this task

2) in case we have an error "The CA certificate is illigal" we need to import certificate with the key file

3) Importing certificate is not enouhg to eliminate the error of SecoClient (untrusted server) , we also need to import certificate to users PC