Why my Certificate signed by the PKI cannot be imported inside my BMENUA0100 webpage ?
BMENUA0100 – CA-Signed Certificate Import Requirements
When the BMENUA0100 is configured in “CA only” or “Selfsign & CA” mode, the Certificate Signing Request (CSR) generated by the BMENUA0100 must be signed by a Certificate Authority (CA).
In some cases, after the CSR has been signed by the CA, the resulting certificate may not be successfully imported through the BMENUA0100 web interface.
Before investigating the certificate itself, ensure that the BMENUA0100 is properly synchronized with an NTP server. Check the date and time displayed on the BMENUA0100 web interface.
The certificate requirements depend on the BMENUA0100 firmware version.
FW 2.03.04
Starting from firmware version 2.03.04, the BMENUA0100 supports PKI architectures using an Intermediate CA.
FW 2.04.02
For firmware version 2.04.02, the following requirements apply when signing a CSR generated by the BMENUA0100.
Subject
The Subject Distinguished Name (DN) contained in the CSR:
- must not be modified by the CA during the CSR signing process;
- must not contain additional attributes compared with the original CSR;
- must not have any attributes removed;
- must preserve the same attribute order as in the original CSR;
- must remain identical to the Subject generated by the BMENUA0100.
Subject Alternative Name (SAN)
The Subject Alternative Name (SAN) contained in the CSR:
- must not be modified by the CA during the signing process;
- must not contain additional entries;
- must not have any entries removed;
- must remain identical to the SAN requested by the BMENUA0100.
FW 3.01
Starting from firmware version 3.01, the requirements related to the Subject DN have changed.
Subject
The following rules apply:
- The CN (Common Name) must be present in the Subject DN.
- The CN must be the first attribute in the Subject DN.
- Other Subject attributes, such as C, ST, L, O, or OU, may be removed.
- The presence of these additional attributes is therefore not mandatory, provided that the CN is present and remains in the required first position.
Figure 1 : Example of a valid Subject DN with the CN in the required first position
Figure 2: Example of an invalid Subject DN with the CN in an incorrect position
Subject Alternative Name (SAN)
The following requirements apply to the Subject Alternative Name (SAN):
- Additional SAN entries can be added like a new DNS
- Existing SAN entries must not be removed.
- The order of the SAN entries may be changed.
Figure 3: Example of Subject Alternative Name (SAN)
Certificate Authority template requirements
The certificate template used by the CA to sign the BMENUA0100 CSR must comply with the requirements described above.
If the CA or certificate template automatically modifies the Subject DN or SAN during the signing process, verify that the resulting certificate still complies with the requirements applicable to the BMENUA0100 firmware version.
For additional information about certificate management and PKI configuration, refer to the BMENUA0100 User Guide.