Sophos XG: Cannot change WAF Certificate

Hello Patrick Wolfensberger,

Thank you for reaching out to the community, ensure the old cert is replaced with the new cert properly:
Further you can follow the WAF troubleshooting guide: https://support.sophos.com/support/s/article/KB-000036242?language=en_US
Log file details: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogFileDetails/index.html
for WAF Check the #tail -f /log/reverseproxy.log

Hello

I could verify that the new certificate name appears in the config file export, but it isn't being used. Furthermore, the command tail -f /log/reverseproxy.log didn't reveal any info about which certificate was being used.

did you notice anything in XG Live Log Viewer for WAF...?
Can you share the screenshot of the config? 

There is nothing unusual going on in the Live Log. It all works fine, just using the wrong certificate. 

I was able to change the SMTP TLS certificate though as well as the web certificate used for the management webpage of the firewall. So the certificate can be used by the firewall, just not by the WAF. No matter which WAF rule I try to change, even ones using completely different certificates (Let's Encrypt), I'm not able to make the change in certificate appear on the browser-side of things. 

Here an example of a WAF rule: 

I get presented with the expired certificate, which is still in the Firewall certificate tab, but cannot be selected anymore in WAF rules. 

even though I used the new one in the rule which is valid until 2023

And I cannot delete the expired certificate, because it claims to be still used somewhere...

Patrick Wolfensberger

The CSC log in debug mode should give you some clue as where the certificate might be being used.

To put csc in debug mode run from the advanced Shell (5>3)

#csc custom debug

Then try deleting the certificate from the GUI.

Stop debugging

#csc custom debug

And then grep for the following "delete_certificate"

# less /log/csc.log | grep "delete_certificate"

I tried something else: There was a deactivated WAF-Rule which was still using the expired certificate. I changed this certificate and within seconds after saving the config of that disabled WAF-rule, everything was up and running with the new certificate. I didn't change anything else...

No idea why, but apparently removing the old certificate from all possible rules did the trick... 

I tried something else: There was a deactivated WAF-Rule which was still using the expired certificate. I changed this certificate and within seconds after saving the config of that disabled WAF-rule, everything was up and running with the new certificate. I didn't change anything else...

No idea why, but apparently removing the old certificate from all possible rules did the trick... 

Hi Patrick, 

Is your disabled WAF rule placed higher than other WAF rules in your Firewall rules list? 

Does your disabled WAF rule show as enabled or disabled in the Firewall rules list (can you share a screenshot)?