Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 45 subscribers
  • Views 9087 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Certificate Update not possible when used in Firewall-Rules

MarkusArndt

Hi,

I have HTTPS-Certificates from LetsEncrypt.com for all my subdomains. I uploaded the Certificate in the XG und used them in many Firewall-WebServer-Protection-Rules.

This Certificates expire after 90 days and I have a Script do renew them easily. When I try to upload the new Cert under same Name I will get an Error because of it exists. Wenn I choose a new Name, I can upload the new Cert with success. Now I can't delete the old one because they are in use from the Firewall-Rules. I have to edit all Roules manually and Switch to the Name of the new Certificate! After that I can delete the old one.

This is not user friendly!

I don't have the time to do this manually every 2 Months so I take a look in the API-Docs. There is the possibility, to update a Certificate. So I spent some time to get it to work with a little selfmade Java-Program, which trys to renew the Certificate under same Name but with new expire-date.

This is funny: I can add a Certificate and update it with same Name without Problems. But when it is used in a Firewall-Rule, the update-process Fails with the undocumented error Code 542. The link in the message to explain it in detail is dead.

The next step is to extract all Firewall-Rules over the API-Call, replace the Name of the Certificate in every rule and update each rule before I can drop the expired one.

This is to much time consuming. When a Firewall-rules changes, I have to observe this and at the end I rewrite the GUI of XG.

Why can't I update an existing Certificate? Do I miss something? I am not the only Person in the world, who have to renew a HTTPS-Certificate?



This thread was automatically locked due to age.
  • 0 in reply to Pieter van Kampen

    Unfortunately my scripts are very unhandy to use. I took a ACME-Java-Implementation that supports DOS-Shell-Commands. Lets-Encrypt validates, that you have control over the Domain before they grant a Certificate. So I must aktivate an XG-Rule, start a part of the script, this moves special files in the Content-Folder from all Web-Servers, uploads to my WebSpace and so on. Then I have to import the Certificates into Exchange (owa) Sophos and so on.

    This process is mostly automated but the Scripts are not universally executeable.

    Extreme anoying is, that I can't replace the Cert in Sophos XG via API, this is most of the work every 3 Months to adjust all Firewall-Rules manually .

    Meanwhile LetsEncrypt offers Wildcard-Certificates to, so it will be usefull to rewrite my logic and take only on Cert insteadof many for all subdomains.

  • 0

    Hi,

    I had exactly the same issue, I tried to add a new certificate (that works) then update all my FirewallRule trough API but I always get errors.

    The solution comes from advanced shell with SSH, I've made a simple bash script here to automatically update Let's Encrypt certificate on my Sophos XG : https://gist.github.com/darylounet/b73584de44209ccb1ce1b3c56c486a7a

    Hope it helps.

Unfiltered HTML