How to change Certificate on Cisco Secure Firewall Management Center

Learn how to manually replace an FMC internal certificate object, update decryption or service references, deploy changes to managed devices, and verify.

Secure Firewall Management Center (FMC) uses Internal Certificate objects for server certificates paired with private keys. Policies and services reference those objects; managed Firewall Threat Defense devices do not receive the change until configuration is deployed.

Before you begin

Record the FMC domain, internal-certificate object, every decryption policy/service reference, and target device list. Export policy/configuration according to the FMC backup procedure. Prepare a paired X.509 v3 certificate and key in PEM or DER as the current release supports.

Step-by-step certificate replacement

Go to Objects > Object Management > PKI > Internal Certs.
Because certificate/key properties of an existing internal object are not generally editable through the GUI, add a new Internal Cert with a unique name. Upload the certificate and paired private key, supply its decryption password, and save. FMC validates that they match.
Edit every decryption rule, ISE/ISE-PIC connection, captive portal, or other consumer to reference the replacement object.
Review the policy diff, select the affected managed device UUIDs, and deploy the configuration. Wait for every deployment task to succeed.
Keep the old object until all devices and services are verified; an in-use object cannot be deleted.

Product-specific considerations

Saving an object only stages FMC configuration. Policies that reference the changed object become out-of-date and must be deployed. Multi-domain FMC environments require the object and policy update in the correct domain. A certificate used by the FMC's own management interface follows a different appliance-certificate workflow.

Verify the new certificate

Inspect the internal object and policy reference, check deployment task status for every selected device, then test traffic matching the decryption/service rule. Review FMC and FTD health/events for certificate or policy errors.

Rollback

Restore policy references to the old object and redeploy to the same devices. Do not delete the replacement until rollback completes on all devices.

Common problems

New object saved but configuration never deployed.
Wrong FMC domain or device set selected.
Certificate/key pair fails validation.
A policy still references the old object.

Automating certificate replacement with aethercert

The aethercert Cisco FMC target creates or updates a named Internal Certificate object and can submit a deployment request for configured device UUIDs. The administrator must select the correct devices and verify the environment-specific policy references.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.