Replace an SSL Certificate on WatchGuard Firebox

A Firebox uses certificates for the web server that serves user authentication and the Access Portal, for VPN, for inbound proxy inspection and other functions. The steps below cover the Firebox Web Server Certificate in Fireware Web UI, the most common case (Policy Manager offers the same functions). A Firebox that is fully managed from WatchGuard Cloud is configured there instead - see Cloud-managed Firebox.

Before you beginCopy Anchor Link

• Record how the device is managed (locally, or fully from WatchGuard Cloud), which certificate is the current web server certificate and which other features use certificates.
• Back up the configuration.
• Keep the PFX file of the current certificate (the file you imported last time). The old certificate is deleted during the procedure, and that file is your only way back to it.
• Get the renewed certificate from your CA as a PKCS#12 file (.pfx/.p12) that contains the certificate, its chain and the private key - or as Base64 (PEM) files. The SAN must contain the name users reach the Firebox by.
• WatchGuard requires both TLS Web Server Authentication and TLS Web Client Authentication in the certificate's Extended Key Usage for any web server certificate imported on the Firebox. Check this before you order.

Step-by-step certificate replacementCopy Anchor Link

1. Identify the current certificate. Go to System > Certificates. The certificate marked with an asterisk is the one in use as the web server certificate.
2. Only for PEM files without the chain: import the CA certificates first - the root CA certificate, then each intermediate - with the certificate function General Use (the category for CA certificates the Firebox uses to build chains). A PKCS#12 file that contains the chain brings it along in step 5.
3. Switch temporarily to the default certificate. The Firebox does not let you delete the certificate currently in use as the web server certificate. On the Firebox Web Server Certificate tab, select the default certificate signed by the Firebox and save. You are logged out; log in again.
4. Delete the old third-party certificate on the Certificates tab.
5. Import the renewed certificate with the import wizard on the Certificates tab, choosing the PFX file or Base64 (PEM) format, and enter the key password.
6. Select it. On the Firebox Web Server Certificate tab, choose Third party certificate and select the renewed certificate from the list. Save.

Between steps 3 and 6 the Firebox serves its default, self-signed certificate: users of the authentication portal and the Access Portal see a browser warning. The steps take a few minutes; do them in a quiet period.

Certificates for VPN, the HTTPS proxy and other features are selected in those features' own settings and policies; update each one that used the old certificate.

Cloud-managed FireboxCopy Anchor Link

For a Firebox that is fully managed from WatchGuard Cloud, add the certificate in WatchGuard Cloud's certificate management, select it for the Firebox, deploy the configuration and wait until WatchGuard Cloud shows that the device has applied it. See WatchGuard's Manage Certificates in WatchGuard Cloud (linked below) for the screens of your version.

A Firebox that WatchGuard Cloud only monitors (cloud-monitored, not cloud-managed) keeps its local configuration and is changed with the Fireware Web UI steps above.

Verify the new certificateCopy Anchor Link

WatchGuard's check: open https://<Firebox name>/sslvpn.html using the FQDN (this page exists when Mobile VPN with SSL or the Access Portal is enabled). There should be no certificate warning, and the expiry date should be the new one. The authentication portal listens on port 4100 by default. From a shell:

openssl s_client -connect firebox.example.com:443 -servername firebox.example.com -showcerts </dev/null
openssl s_client -connect firebox.example.com:4100 -servername firebox.example.com -showcerts </dev/null

Check subject and SAN, issuer, expiry date and the chain, and test every VPN and proxy endpoint that uses a certificate.

RollbackCopy Anchor Link

• Before step 4 (the old certificate still exists): select it again as the third-party certificate on the Firebox Web Server Certificate tab.
• After step 4: import the PFX of the old certificate you kept, and select it. Until then, the default certificate keeps the Firebox working, with a browser warning.

Rolling back only makes sense while the old certificate is still valid.

Common problemsCopy Anchor Link

• The chain was imported after the leaf, or with a certificate function other than General Use.
• The old certificate could not be deleted because it was still the web server certificate - switch to the default first.
• The certificate lacks the TLS Web Client Authentication EKU.
• The certificate was imported but not selected as the third-party web server certificate.
• A monitored-only Firebox was treated as cloud-managed.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert WatchGuard target uses WatchGuard Cloud's API to create and submit a certificate installation for a fully cloud-managed Firebox. WatchGuard's API documents the install as asynchronous, so confirm completion and the feature assignment in Cloud.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• WatchGuard: renew or replace an expired third-party web server certificate
• WatchGuard: import and install a third-party web server certificate
• WatchGuard: configure the Firebox web server certificate
• WatchGuard: manage device certificates in Fireware Web UI
• WatchGuard: manage certificates in WatchGuard Cloud