SA520W: difficulty getting self certificate request signed by trusted 3rd party

Question

Please forgive me if this is a dumb question or if I am fundamentally confused, but I have pored over the manual, forum, and web.  Very simply I need a trusted third party to sign my CSR and then for the SA520W to accept it as the active self certificate.  In principle this is straightforward but I cannot figure out how to make this work in practice.  Two examples.
1) GoDaddy:  they require a 2048 bit signature and the router only generates 1024.  I can generate my own CSR with OpenSSL but then am unable to upload my 2048 bit key to the router, and thus the signed certificate is not accepted
2)  Verisign.  They will take the router's 1024 bit signature, but they require lots of fields in the CSR, like country and state, that are not supported by the router's generate CSR function.  Thus Verisign will not accept the CSR.
Is there any way to get the router to accept a CSR signed by GoDaddy?  Or any CA?
Thanks in advance.
Andy

Answer 1

Sorry to dredge up an old thread, but I've been trying to get this to work for the last three weeks also.
The firmware supports a 2048 bit key, so that's not the issue.
I entered all the information that the registrar wanted into the CN field, in the correct format.
The registrar has accepted the CSR and generated the certificate, and returned it to me.
I'm using a Geotrust quickSSL certificate.
Now, the issue is that I can't upload the certificate. If I try and load it, I get the error;
"No trusted certificate found, Can't Upload Self Certificate"
So, I'm guessing it is a chaining issue. I go to http://www.geotrust.com/resources/root-certificates/
I download the Root 1  "Download - Equifax Secure Certificate Authority (Base-64 encoded X.509) Right Click, Save As"
and then I try to add it to the SA520 as a trusted certificate...
"Added Trusted Certificate"
Now I try adding my signed certificate again, and get the error;
"No trusted certificate found, Can't Upload Self Certificate"
So we're still missing something (intermediate certificate(?)), so I try adding the next one in the list;
I download Root 2 "Download - GeoTrust Global CA (Base-64 encoded X.509) Right Click, Save As"
and try to add it to the SA520 as a trusted certificate...
"Cannot Add Trusted Certificate"
So I try the next one...
I download Root 3 "Download - GeoTrust Primary CA (.pem file) Right Click, Save As"
and then I try to add it to the SA520 as a trusted certificate...
"Added Trusted Certificate"
So, once again, I try my signed certificate and get the same error;
"No trusted certificate found, Can't Upload Self Certificate"
So I give up on the Cisco, and go to a Mac which has great keychain management.
I open my signed certificate on the mac, and see it is issued by "GeoTrust DV SSL CA"
Hang on, that's the "Root 2" certificate above that wouldn't load. I try add the Root 2 again, but I get the same error
So I contact Geotrust and get them to send me the DV SSL CA file, which I upload successfully.
Now, I have three trusted Certificates from Geotrust loaded.
Trusted Certificates (CA Certificate)
CA Identity (Subject Name)
Issuer Name
Expiry Time
C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
May 21 04:00:00 2022 GMT
C=US, O=GeoTrust Inc., OU=Domain Validated SSL, CN=GeoTrust DV SSL CA
C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
Feb 25 21:32:31 2020 GMT
C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
C=US, O=GeoTrust Inc., CN=GeoTrust Primary Certification Authority
Jul 16 23:59:59 2036 GMT
So I try once again to upload my signed certificate, and once again, I get:
"No trusted certificate found, Can't Upload Self Certificate"
So, the question is, WHAT is going on ? Has anyone at Cisco managed to load a GeoTrust certficate into this device, if so, step by step, HOW ?
Thanks !