Replace a Certificate on Cisco Secure Firewall (FMC)
Replace an internal certificate object in Cisco Secure Firewall Management Center for Decrypt - Known Key rules, repoint the rules, deploy to managed devices and verify.
Secure Firewall Management Center (FMC) stores a server certificate with its private key as an Internal Certificate object. The typical user is a decryption rule with the action Decrypt - Known Key: the firewall decrypts traffic to one of your own servers by using that server's certificate and private key. Managed Firewall Threat Defense (FTD) devices only receive a change when the configuration is deployed to them.
For Decrypt - Known Key, the object must hold the same certificate and key as the server. When the server's certificate is renewed, the FMC object has to be replaced at the same time - otherwise the firewall can no longer decrypt that server's traffic. Plan both changes together.
Before you begin
- Record the FMC domain, the internal certificate object, and every rule that uses it: open the decryption policy under Policies > Access Control > Decryption and look for rules that select the object. Note which devices the policy is deployed to.
- Back up FMC (System > Tools > Backup/Restore).
- Get the server's new certificate and its private key in PEM or DER, and the key's password if it is encrypted.
Step-by-step certificate replacement
- Go to Objects > Object Management > PKI > Internal Certs and click Add Internal Cert.
- Enter a name that shows purpose and year (for example
web01-2026), paste or browse to the certificate and the private key, select Encrypted and enter the password if the key is encrypted, and save. FMC checks that certificate and key belong together. - Open the decryption policy (Policies > Access Control > Decryption > edit the policy), edit each Decrypt - Known Key rule that used the old object, select the new object, and save the policy.
- Deploy at the same time as the certificate change on the server: click Deploy, select the affected devices and deploy. Saving objects and policies only changes FMC; the devices keep the old configuration until the deployment has succeeded for each of them.
- Keep the old object until every device is verified. FMC does not let you delete an object that is still in use by a policy - if the delete is refused, a rule still references it.
FMC and FTD 10.0 and later
Version 10.0 added the option to change the certificate and key that a decryption rule uses at any time. Cisco's release notes name three ways to do it: in Object Management, through the API, or from an ACME-based system. The rule itself does not have to be reworked, but the change still reaches the devices only after you deploy the policies that are now out of date.
Product-specific considerations
In a multi-domain FMC, create the object and change the policies in the correct domain. The certificate of FMC's own web interface is a separate appliance certificate and is not changed by internal certificate objects.
Verify the new certificate
-
In Deploy > Deployment History, check that the deployment succeeded on every selected device. If the Deploy button still shows pending changes, something has not been deployed.
-
Check the certificate the server now presents - it must be the one in the new object:
openssl s_client -connect web01.example.com:443 -servername web01.example.com </dev/null | openssl x509 -noout -fingerprint -sha256 -
Generate traffic that matches each rule and check the connection events and FTD health for decryption errors.
Rollback
Select the old object in the rules again and deploy to the same devices. This only helps as long as the server still uses the old certificate and that certificate is still valid - if the server already presents the new certificate, roll the server back too, or fix the new object instead. Delete the new object only after the rollback has completed on all devices.
Common problems
- The server got its new certificate, but FMC still has the old one, so decryption fails.
- The new object was saved but never deployed.
- The wrong domain or set of devices was selected.
- Certificate and key do not belong together and the object is rejected.
- A rule still references the old object.
Automating certificate replacement with aethercert
The aethercert Cisco FMC target creates or updates a named Internal Certificate object and can submit a deployment request for configured device UUIDs. The administrator must select the correct devices and verify the environment-specific policy references.
See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.