How to Create a PKCS12 (.p12) Certificate for Sophos UTM 9 with OpenSSL

Sophos (formerly Astaro) UTM 9 imports certificates for its Web Application Firewall as PKCS12 (.p12) files. Here’s how to create one with OpenSSL, from private key to import.

Note: run these commands on a separate Linux or Windows machine with OpenSSL installed, not on the firewall itself.

1. Generate a Private Key

Pick an encryption algorithm and key length. Any of these work:

openssl genrsa -des3 -out <private key file name>.key 2048
openssl genrsa -aes128 -out <private key file name>.key 2048
openssl genrsa -aes256 -out <private key file name>.key 2048
openssl genrsa -aes256 -out <private key file name>.key 4096

2. Generate a Certificate Signing Request (CSR)

openssl req -new -key <private key file name>.key -out <csr file name>.csr

Follow your certificate authority’s requirements for the CSR fields. VeriSign, for example, wants no email address, challenge password, or optional company name.

3. Submit the CSR to Your Certificate Authority

If you copy and paste the CSR text, use Notepad or vi, never Microsoft Word, which can alter the formatting.

4. Create the PKCS12 File

openssl pkcs12 -export -in <certificate from your CA>.crt -inkey <private key file name>.key -out <your filename>.p12

If your certificate and key are PEM files instead:

openssl pkcs12 -export -in xxxx.pem -inkey xxxx.pem -out xxx.p12 -passout pass:newpassword -name "newname"

5. Import the PKCS12 File into Sophos UTM

1. Go to Web Application Firewall → Certificate Management → New Certificate.
2. Choose Upload, file type PKCS12, select your .p12 file, and save.

6. (Optional) Import the Intermediate CA

If your CA uses an intermediate certificate, go to Web Application Firewall → Certificate Management → Certificate Authority → Import CA and upload the verification CA as a PEM file.