Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 2 subscribers
  • Views 18026 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to automate certificate imports?

MichaelSieben

Hi,

we're planning to shorten our certifcates lifetimes and for this reason we are looking how to automate our certificate handling.

Is there a way to import certficates into the UTM without user interaction?

Thanks in advance

Michael



This thread was automatically locked due to age.
  • 0
    I don't know. Seems to be e new feature.
    Maybe with https://letsencrypt.org/ ? There is a feature request for that: feature.astaro.com/.../10409280-let-s-encrypt-integration
  • 0
    There is not currently a way of doing this. You would need to Upload via WebAdmin.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    i am trying to find the file location on the UTM but it doesn't seem to save them as a file so i guess it must be imported to a database. I was thinking of using a "slave" linux vm to generate the letsencrypt certificates and than upload them via ssh to the sophos.

    ---

    Sophos UTM 9.3 Certified Engineer

  • 0
    More and more people are going to be asking for this same feature. Having certificates with a long lifetime is bad security practice, so having a way to have the firewall automatically request renewed certificate is essential. With the advent of free certificates from letsencypt.org (now open to the public) many will be expecting this feature. Being able to load them from another host would also (possibly more so) be important since if you encrypt end-to-end you need the certificate on both the webserver and the firewall.
  • 0 in reply to theRat
    is sophos storing the certifcates you upload via webgui in a database? I cannot find them on the filesystem. Maybe there allready is a way to manually import a certificate via CLI over a SSH connection. That would make it scriptable. Anyone?

    ---

    Sophos UTM 9.3 Certified Engineer

  • 0 in reply to theRat

    Not entirely sure I trust an automated system to auto request and deploy my certificates for me. Working for a security outfit and being the Cert Authority Controller, I want to be in full control of how my certificates are processed, when they are requested/signed and to examine the cert before deployment. Relying on automation feels lazy and laziness leads to lacklustre security which can lead to a breach.

    I'm only saying this because what if your automated certificate requester was breached/compromised internally and configured to request Certs from a compromised signing authority?

    To request, await signing, download, package and deploy takes about 10-20 minutes of my time every few months.

Unfiltered HTML