Replace an SSL Certificate on Sophos Firewall

Sophos Firewall (SFOS) keeps uploaded certificates separately from the services that use them. The web admin console and user portal, SSL VPN, web server protection (WAF) rules and other features each select their own certificate. By default they use the built-in ApplianceCertificate, which browsers do not trust.

Before you beginCopy Anchor Link

• Record the current certificate name and every service that uses it: admin console and portals, SSL VPN, WAF rules, IPsec connections, and the HA state.
• Back up the configuration (Backup & firmware > Backup & restore).
• Prepare the certificate with its private key. SFOS accepts PEM, DER, CER, PKCS#7 and PKCS#12 (.pfx/.p12) files, with RSA or ECC keys. A key passphrase may be at most 30 characters - re-export the PFX with a shorter one if needed.
• Make sure the firewall clock is synchronized with NTP. Sophos notes that a manually set clock can make certificate imports fail.
• If SSL VPN is affected, plan for users: after the SSL server certificate changes, each user has to click Update policy in the VPN client.

Step-by-step certificate replacementCopy Anchor Link

1. Go to Certificates, open the Certificates tab and click Add. Select Upload certificate and enter a name that shows purpose and year, for example vpn-2026.
2. Select the Certificate file format - PKCS12 for a .pfx/.p12 file, which contains certificate and key; for PEM, also upload the private key - enter the passphrase and save.
3. If the certificate was issued by an intermediate CA, upload the intermediate and root CA certificates on the Certificate authorities tab. For SSL VPN, Sophos states explicitly that the server certificate needs its intermediate and root CAs on the firewall.
4. Select the new certificate in every service that should use it:
   • Admin console and portals: Administration > Admin and user settings > Admin console and end-user interaction > Certificate. This certificate is used by the web admin console, user portal, captive portal and the SPX portals - one setting for all of them. In the same section, the hostname option controls which name the firewall uses in links to these portals; it should be a name the certificate covers.
   • SSL VPN: Remote access VPN > SSL VPN > SSL VPN global settings > SSL server certificate.
   • Web server protection (WAF): Rules and policies > Firewall rules, edit each web server protection rule that publishes over HTTPS, and select the new certificate in its HTTPS certificate field.
   • IPsec: connections that authenticate with a certificate reference it in the connection settings.
5. Save each change. No reboot is needed, but changing the admin console certificate can end your current session - log in again with the new certificate.

If the import failsCopy Anchor Link

• Wrong passphrase, or a passphrase longer than 30 characters. Re-export the PFX with a shorter one:

  Copy Text

  openssl pkcs12 -in old.pfx -nodes -out temp.pem
  openssl pkcs12 -export -in temp.pem -out sophos.pfx

  Delete temp.pem afterwards - it contains the unencrypted key.

• Certificate and private key do not belong together.

• The file format selected does not match the file.

• The firewall clock is wrong; synchronize it with NTP.

Verify the new certificateCopy Anchor Link

Connect to each service by the name in the SAN:

openssl s_client -connect fw.example.com:4444 -servername fw.example.com -showcerts </dev/null
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null

Use the ports configured on your firewall (the admin console default is 4444). Check subject and SAN, issuer, expiry date and that the intermediate is sent. Test the admin console, user portal, an SSL VPN connection after Update policy, and each published web server. In an HA pair, check the HA status and test after a failover.

RollbackCopy Anchor Link

Select the previous certificate again in every service you changed and save. SSL VPN users have to click Update policy once more. Keep the old certificate and its CA chain on the firewall until every service is verified - rolling back only helps while the old certificate is still valid.

If the admin console no longer loads after the change, the device console (SSH or serial) offers an option to reset the web admin certificate to the default; see Reset Web admin certificate in the Sophos command-line help. If in doubt, restore the configuration backup.

Common problemsCopy Anchor Link

• The certificate was uploaded but no service was switched to it.
• The intermediate or root CA is missing.
• The admin console was tested, but SSL VPN or a WAF rule still uses the old certificate.
• SSL VPN users did not click Update policy after the server certificate changed.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert Sophos Firewall target uploads a named certificate, chain, and private key through the Sophos API. Feature-specific assignment remains an administrative configuration decision.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Sophos Firewall: add a certificate
• Sophos Firewall: add external certificate and CA chain
• Sophos Firewall: admin and user settings
• Sophos Firewall: reset web admin certificate (CLI)
• Sophos Firewall: SSL VPN global settings