Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

8 years plus running no solution to Certificate could not be updated as it is already used by HTTP Based Policy

When I go to edit the certificate and upload the certificate which is due for renewal ( every 13 months ), it fails with the following error at the top center of the screen:

Certificate could not be updated as it is already used by HTTP Based Policy

Firmware: (SFOS 20.0.1 MR-1-Build342) 

I have 40+ WAF rules managing multiple domains.

1. Go to certificates

2. Add new certificates with different name as it doesn't allow updating same certificate 

3. Then go to WAF rules one by one ( 1....40+ ), change new certificates update FQDN isn't this annoying ?????

4.   Its been 5 Years I have been using Sophos XG literally fed up with repeated task

Its even costing me with downtime.

Its been issue over 8+ years still Sophos not addressed see below:

 Certificate renewal fails if used in web server protection rule 

 Certificate could not be updated as it is already used by HTTP Based Policy 

I raised support ticket as of 2024-07-26 Sophos doesn't feasible solution. ( Case Number: 07455429 )

I see below paths hold certificate & private key,  its a job of replacement of file & restart of WAF  still Sophos developers didn't consider to implement over UI over 8+ years!!! can't they simplify ???

/conf/certificate/

/conf/certificate/private/



This thread was automatically locked due to age.
Parents Reply
  • API is okay I understand its doing same process.

    Why not just below procedure will not work 

    1. stop WAF under services

    2. Disable WAF rules

    3.  Certificates -> select existing -> upload certificate on renewal -> save

    4. enable WAF under services

    5. Enable WAF rules.

    I still didn't understand when rules are disabled it should atleast work.

Children
No Data