Thread Info
  • Replies 122 replies
  • Subscribers 60 subscribers
  • Views 125148 views
  • Users 0 members are here
Options
Suggested

Sophos Firewall: [LetsEncrypt] How To in Sophos Firewall

LuCar Toni

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

Note: Make sure your Sophos Firewall time is correct to avoid potential Certificate Trust issues

Overview

This Recommended Read reviews different options for obtaining a Let's Encrypt certificate.

UTM has LE Support for WAF (since UTM9.6). But on Sophos, you can use LE certificates as well. Seems like many people does not know, you need a little Linux server and 5-10 minutes of your time each three month. Or you can automate this. 

First of all, I want to share the "how it works" page of LE. https://letsencrypt.org/how-it-works/

My Setup. 

Internet - Sophos - Ubuntu 20.04 LTS
Ubuntu has "certbot" installed. Feel free to use other LE modules.
https://certbot.eff.org/ https://certbot.eff.org/lets-encrypt/ubuntubionic-apache
Follow straight the Guide for your OS. I am relying fully on those apps for the renewal process.  

Next, I am choosing the HTTP-01 method for LE, so I need a DNAT for LE to my Ubuntu.

(V18). 

PS: I am using HTTP DNAT for the renewal process and deactivate those Rules after the process. But you can also use only the LE IPs: 
https://community.letsencrypt.org/t/can-i-get-list-ip-from-letsencrypt/57117
PS2: You could switch to the DNS validation as explained in this Community thread.  

The next step would be to check your Domain. Your DNS A-Record should point to your WAN IP. Otherwise, this process won’t work. 
So perform a dig / nslookup of your domain. It’ll point to your WAN IP, so your DNAT will work, and HTTP packets will be forwarded to Certbot. 
You can also use the Sophos free DDNS service. https://community.sophos.com/kb/en-us/123126 

Certbot

Let us start Certbot and try it. 
My renewal process is straightforward:


(Be careful: LE blocks you after couple of "failed" requests for some time. So check everything).
Ultimately, you’ll get four files on your Linux: Public, Chain, Fullchain, Privatkey Certificates. 

Upload to Sophos Firewall

You’ll use this Public and Privatkey certificate. 
There are a couple of approaches to upload this to Sophos. 

The first LE Cert can be uploaded. 
You should use the Public.pem in "Certificate" and the Privatkey in "Privat key". 
PS: you have to rename the Privatkey.pem to Privatkey.key. Otherwise, Sophos won’t take this certificate. 

Optionally, you can upload the other Chain and fullchain Certificate under Certificate Authorities (Without Privat key). 
Now, you can use this Certificate for WAF/Webadmin. 

In case of renewal (each 90 Days), you have to choose a process.

Automation 

You can upload the new LE certificate with another Name and replace it in WAF/Webadmin. 
Or you can "update" the current LE certificate with the new public.pem / privat.key. But for this method, you have to switch to a fallback certificate in WAF/Webadmin, because Sophos can't update a currently used certificate.  

After all, those steps are manual processes every 90 Days. 
You can "script" this if you want to. So basically, upload the certificate every 90 Days to Sophos. 


Other members of the community have already performed scripts for this.

If you want to script this, this community can help you if you struggle with a point.
So please open a new thread with your issue with the API, and we’ll try to find a solution. 

Sophos Factory

Sophos Factory brings a new Tool to automate Script-based approaches. This means you can easily run a Script like Certbot or Lego in a Sophos Factory environment to generate and upload the certificate to the Sophos Firewall. 

Sophos Factory offers a free Community Edition. https://community.sophos.com/sophos-factory/ https://community.sophos.com/sophos-factory/b/release-notes-news/posts/get-started-here-sophos-factory-offer-automation-for-all-with-its-free-community-edition

Within Sophos Factory, it could look like this:

Each step is one scripting component.By using tools like Lego and Github, the "Pipeline" will run one time, generate the certificate and upload it to the Firewall. 

Contribution:
  https://zerossl.com/free-ssl/#crt Free alternative to this approach
For the Github script. 
 Thanks for the PHP Script! 
 for a Powershell Script with WAF integration. 
 for another version of a Powershell Script. 



Edited Links
[edited by: emmosophos at 10:23 PM (GMT -8) on 5 Mar 2024]
Parents Reply Children
  • in reply to LuCar Toni

    Actually I would also consider this kind of a makeshift solution.
    Plus - when I saw it right, I need to setup a second system. And don't upload them manually? Now way we'd do this!

  • in reply to LuCar Toni

    No, i dont want to have to run scripts on a second computer. This is something that can easy run on the XG. 

    And i really get the feeling that Sophos is not listening to the customers. There are so many User Voice stuff that is not coming. 

  • in reply to Björn Bendix

    What about a platform to do automation entirely? 

    See: Sophos Factory. 

    Sophos has this feature in the backlog for future implementation. The Implementation could differ from the other products. While UTM did a HTTP only approach, SFOS could go the direction to do it via DNS. ACME/LetsEncrypt supports a Certificate renewal process by a third party. That is the approach, which looks way better.

    For example: You simply point your DNS to Central. Central will renewal your Certificate and push it to the firewall. That is the better approach, as it will give you a Wildcard Certificate, you will get the certificate all the time, without having a Webserver running on the firewall etc. This would mean, no ties to Webserver Protection Subscription as well. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    Nope, its not easy to have this Sophos connected to the DNS Service. Lets see whats coming. But at the moement from the customer view, im not happy with sophos any more. Lets see what is going on, and in the meantime im looking for other solutions on the market ;)

  • in reply to LuCar Toni

    DNS Options are much more secure than the web Option.

    Just have an acme DNS entry pointing to Central and handle the Setup there seems to be nice. But please not only wildcards. Keep in mind customer might have diffrent Lets Encrypt DNS solutions. And pointing to Central might not be possible.

  • in reply to Björn Bendix

    Sophos will not connect to DNS. You will simply point one DNS Record to the DNS Services of Sophos. This means by using CNAME. It is one ACME CNAME you will maintain one time, which is sufficient to do this. 

    __________________________________________________________________________________________________________________

  • in reply to Björn Bendix

    I cannot give a date. Until then, you could look at Sophos Factory if you want to expand your business anyway to Automation. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    Yes I know, I am doing this. But when you point the wildcard acme to Central, I am not able to use it for other acme setups.

    Even when pointing a server1.cutomer.de acme to Central I am not able to use it for ther internal acme stuff.

    With this approach, I must be able to use the central DNSAPI, too.

    Customer example: acme CNAME in main domain to a DNSAPI domain. Acme scipt write only data to DNSAPI domain.

  • in reply to Sven OlafSchuran

    You can overwrite the CNAME with a own txt record all the time, if you want. This means, you are still in control of your domain, if you want to generate additional ACME Certificates. Simply remove the CNAME and update your own DNS txt record and generate your scripts. DNS will always be used for the entire domain. 

    I highly doubt, Sophos will implement a Certificate store for you. Which means, the firewall is not your central certificate store to renewal and upload to other products. 

    That should be (especially from a automation and security perspective) a automation tool in a docker container. Like Sophos Factory. 

    Take a look at this tool, it can actually do exactly this. It will store the data only in processing, upload it to your desired places / machines etc. 

    __________________________________________________________________________________________________________________

Unfiltered HTML