How to change Certificate on Sophos Firewall

Learn how to manually upload and activate a replacement certificate on Sophos Firewall, import the CA chain, update service references, and verify TLS.

Sophos Firewall keeps uploaded certificates separately from the services that use them. Administration, user portal, VPN, web publishing, and other features can select different certificates.

Before you begin

Record the current certificate name, every service reference, HA state, and CA chain. Back up the firewall configuration. Prepare a supported PEM, DER, or PKCS#12 input with the matching private key; Sophos documents password constraints for encrypted keys.

Step-by-step certificate replacement

Go to Certificates > Certificates > Add. Choose the correct file format and upload the certificate and private key; enter the passphrase and save.
Under Certificates > Certificate authorities, import missing intermediate/root certificates. Do not treat a leaf upload as a complete trust chain.
Update each intended consumer. For the admin console/user portal, use Administration > Admin and user settings and select the certificate. Update VPN and web-publishing rules separately where they reference a certificate.
Apply the configuration and verify HA synchronization. Sophos normally activates the object/reference change without a full appliance reboot, but a management certificate change can interrupt the current session.

Verify the new certificate

Reconnect using the hostname in the SAN and inspect the served certificate. Test admin, user portal, VPN, and published services independently, plus both HA nodes.

Rollback

Reselect the old certificate in every changed consumer and apply. Retain both the old leaf and its CA chain until validation finishes.

Common problems

Certificate uploaded but not selected by a service.
Private-key passphrase violates the appliance's limits.
Intermediate/root CA is absent.
Management is tested while VPN/published service remains stale.

Automating certificate replacement with aethercert

The aethercert Sophos Firewall target uploads a named certificate, chain, and private key through the Sophos API. Feature-specific assignment remains an administrative configuration decision.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.