How to change Certificate on WatchGuard Firebox

Learn how to manually replace a TLS certificate on WatchGuard Firebox, import the chain in order, select it for authentication or proxy use, and verify.

Firebox uses certificates for web authentication/management, VPN, inbound proxy inspection, and other functions. The import category and later service selection must match the intended use. Cloud-managed and locally managed Fireboxes use different interfaces.

Before you begin

Record the device management mode, existing certificate function, chain, and every policy/service reference. Back up configuration. Prepare PFX or Base64 PEM with the private key. For Firebox web server certificates, WatchGuard requires TLS Web Server and TLS Web Client Authentication EKUs.

Step-by-step certificate replacement

Import CA certificates first, from root through intermediates, as General Use so Firebox can build the chain.
In Fireware Web UI go to System > Certificates > Import Certificate. Choose the correct function, upload PFX/PEM, enter the key password, and use Overwrite if certificate already exists only for an intentional same-name replacement.
For the Firebox Web Server certificate, open its configuration page, choose Third party certificate, select the imported certificate, and save. Configure Proxy Server, VPN, SMTP proxy, or other uses in their own policy pages.
For a fully cloud-managed Firebox, perform the corresponding certificate import and authentication-certificate selection in WatchGuard Cloud and wait for the device to receive/apply the change. A cloud-monitored, locally configured device cannot be managed as if it were fully cloud-managed.

Verify the new certificate

For web authentication, WatchGuard documents testing https://<firebox-name>/sslvpn.html. Inspect every VPN/proxy endpoint separately and confirm the device configuration status in WatchGuard Cloud where used.

Rollback

Reselect or reimport the old certificate and its chain, then save/deploy. Do not remove an active certificate without a replacement; Firebox can fall back to a default certificate after restart.

Common problems

Chain certificates imported after the leaf or with the wrong category.
Certificate imported but not selected for the desired function.
Missing client/server EKUs for a Firebox web certificate.
A monitored-only Firebox is mistaken for a cloud-managed device.

Automating certificate replacement with aethercert

The aethercert WatchGuard target uses WatchGuard Cloud's API to create and submit a certificate installation for a fully cloud-managed Firebox. WatchGuard's API documents the install as asynchronous, so confirm completion and the feature assignment in Cloud.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.