STEP 1

Select Configuration > SSL > Keyrings. Create a new keyring  (Add Keyring) for the ProxySG ex. proxysg.yourdomain.local or test . Select Show Keypair based on your security policy. Click OK and Apply to save your changes.

STEP 2

Edit the keyring created above.

STEP 3

Click Create under Certificate Signing Request at the bottom.

STEP 4

Fill appropriate information into the request. The Common Name can be set to reflect what users should see if viewing certificate details(e.g. Bluecoat SSL interception) Click OK, then Close, then Apply.

NOTE: Common name should reflect the hostname or FQDN of the ProxySG (documentation) ex. proxysg.yourdomain.local

Complete the form, paying close attention to the Common Name field. This should be a hostname or FQDN that resolves to the ProxySG appliance from outside of your protected network. This is the first step in ensuring that Internet-based browsers can trust the certificate the appliance presents.

NOTE: SOME ENVIRONMENTS NEEDS ADDITIONAL ATTRIBUTES FOR THE CSR, WHICH CAN BE ONLY CREATED VIA CLI (versions without SGAC)

If there's no SubjectAltName attribute in the certificate the site will still be shown as insecure with ROOTCA installed. It is advised to create a CSR with SAN over the CLI rather than GUI.

Procedure is almost the same. Keyring can be created from the GUI or CLI:  

Proxy> enable
Proxy# config t 
Proxy (config)# ssl
Proxy (config-ssl)# create keyring  no-show <keyring-name> 2048

Then CSR can be made using this keyring 

Proxy (config-ssl)# create signing-request <keyring-name>

  Country code []: US
  State or province []: 
  Locality or city []: 
  Organization name []: 
  Organization unit []: 
  Common name []: proxysg.yourdomain.local
  Email address []:
  Challenge  []:
  Company name []: 
  Digest type (sha1, sha224, sha256, sha384 or sha512) [sha256]: sha256
  Subject alternative name []: IP:192.168.1.156,DNS:proxysg.yourdomain.local,DNS:proxysg1
  Key usage []:
  Extended key usage []:
  Basic constraints []:

* REQUIRED

(SAN) SubjectAltName attributes > check the formating , worht to add the DNS and IP of ProxySG

Then you can see the CSR from the CLI

Proxy (config-ssl)# view signing-request <keyring-name>

STEP 5

Edit the created Keyring. At the bottom will now be a certificate signing request (CSR). Copy this text to the clipboard. Click Close.

Ex.

-----BEGIN CERTIFICATE REQUEST-----

[...]

LBlY3B15/Vv3qtjsGSsmn9oWvkrEbL1c/f29LBcB0F6XqpnavUrIlLt79inLHZFx

3QRKTPDs2JLJYfzJaBY7m6oRYVZ1NleFcK1oMyFVGLCVkw4=

-----END CERTIFICATE REQUEST-----

STEP 6

Save this text in a file and give it a name such as proxysg.csr. Click Close.

Complete the following steps using Internet Explorer:

STEP 7

In Internet Explorer, open the URL of the Mirosoft Certificate Authority server. Generally, the default URL is http://server/certsrv   (in our ex. dc.yourdomain.local/certsrv)

STEP 8

Click Request a certificate.

STEP 9

Click advanced certificate request.

STEP 10

Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request using a base-64-encoded PKCS #7 file.

STEP 11

(Optional)  You may be prompted to install "Microsoft Certificate Enrollment Control ActiveX".  Click Accept and continue.

STEP 12

In the Saved Request field, copy the CSR created above on the ProxySG. Select Subordinate Certificate Authority   for the Certificate Template. Click Submit.

NOTE: You can be notified that CA already exists, then you can skip.