FRITZ!Box HTTPS Certificate Import Fails with "Invalid Certificate" Error

Issue

When attempting to import a certificate on a FRITZ!Box router for HTTPS, the router may display an "invalid certificate" error and refuse to accept the certificate.

This can occur even when the certificate has been successfully issued by an internal certificate authority and exported as a .pfx file.



Cause

FRITZ!Box routers do not accept certificates in .pfx (PKCS#12) format for HTTPS certificate imports. The certificate and private key must be provided in PEM format.

Additionally, FRITZ!Box certificate imports require an RSA certificate. Certificates issued using ECDSA or other unsupported key types may fail to import.

When issuing certificates from Active Directory Certificate Services (AD CS), ensure the certificate template allows the private key to be exported. If iPhone devices will be used to access the FRITZ!Box interface, avoid marking the Application Policies extension as critical.



Resolution

  1. Create or modify a certificate template in Active Directory Certificate Services (AD CS) for router certificates.

  2. Configure the template to use an RSA key and allow the private key to be exported.

  3. Issue and enroll the certificate to a workstation.

  4. Open the Certificates MMC console and export the certificate as a .pfx file, including the private key.

  5. Install OpenSSL on a Windows workstation.

  6. From an elevated Command Prompt, convert the .pfx file to PEM format using the following command:
    7. openssl pkcs12 -in C:\mypfxfile.pfx -out C:\outputfile.pem -nodes
  7. Log in to the FRITZ!Box administration interface.

  8. Import the newly created .pem file.

  9. Verify that HTTPS access is functioning correctly and that the certificate is presented as expected.

Certificate Requirements

Date Created: Thursday, 7 November 2019, 8:50 PM