Certificates For Cloud-Managed Fireboxes API

You can manage your account certificates and Firebox certificates for cloud-managed devices in WatchGuard Cloud. For more information, go to Manage Certificates in WatchGuard Cloud.

Certificate operations work only with cloud‑managed Fireboxes that store configuration in WatchGuard Cloud. They do not work with locally‑managed Fireboxes, including those with WatchGuard Cloud reporting, because these devices store no configuration in WatchGuard Cloud. The API returns an empty response for locally‑managed Fireboxes.

You can use the Firebox Certificate Management API to:

Create a Certificate
Install a Certificate
Delete a Certificate
Get Certificates

Endpoints:

/{v1}/configuration/{accountid}/system/certificates

/{v1}/command/{accountid}/system/certificates/install

/{v1}/configuration/{accountid}/system/certificates/{objectid}

/{v1}/configuration/{accountid}/system/certificates

/{v1}/configuration/{accountid}/system/certificates/{objectid}

Create a Certificate

/{v1}/configuration/{accountid}/system/certificates

Make a request to this endpoint to create a certificate for a WatchGuard Cloud account or for a specific device. Certificates must be in Base64 PEM encoded format or PFX file format.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Body

The information you must provide in the request body depends on the type of certificate configuration you want to add:

Add an account-level certificate to a WatchGuard Cloud account

name string REQUIRED	Name of the certificate. This can include only letters, numbers, spaces, parentheses "()", asterisks "*", periods ".", hyphens "-", and underscores "_". Maximum: 58 characters. Example: AccountCert
description string	Optional text description of the certificate. You can use the description to identify the purpose of the certificate. Example: My Account Certificate
pem string	Certificate content in PEM format. Includes the public certificate block. Example: "-----BEGIN CERTIFICATE-----......-----END CERTIFICATE-----"
pvt_key string	Private key associated with the certificate, in PEM format. Required for certificates that use private/public key pairs. Account-level certificates are in PEM format. Example: -----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASC...\n-----END PRIVATE

Example Request

This request adds an account-level certificate to a WatchGuard Cloud account.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/system/certificates
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJjYjhVTzJlelpWaGZzVnZnYhGni-J2eJvbTn9ZwaRSAb9XT2CgVZX61UwZ9pQoMGpe4z620W56VOxQuxrTgjqGYHj5-K2oDCWhRWV7BANnUar6vguyGO4_M99Aht4kJlDZp482uMnY79ziK60_LRrnBPi6jPBalHVVfUOeykN_BT9foEDbO1-CTTGj-MC19ltkEX4gfODa9lqXw8lSzQ-SfXFHoCfFOflzYjXUQ_iAAL7lfw1WU31tAepmAa2YZ7M1LTOtIuP5ckHCqghlYNXafQ'
	-d '{
	"name": "AccountCert",
	"description": "", 
	"pem": "PEM String",
	"pvt_key": "Private Key String"
	}'

Add a device-level PEM certificate to a Firebox in a WatchGuard Cloud account

device string integer REQUIRED	Required when you create or install device-level certificates. Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID of a standalone device can be a string or an integer. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345 or FB-12345. For FireClusters, specify the full device ID. For example, FBCL-12345. Example: FB-12345
name string REQUIRED	Name of the certificate. This can include only letters, numbers, spaces, parentheses "()", asterisks "*", periods ".", hyphens "-", and underscores "_". Maximum: 58 characters. Example: AccountCert
description string	Optional text description of the certificate. You can use the description to identify the purpose of the certificate. Example: My Account Certificate
pem string REQUIRED	Certificate content in PEM format. Includes the public certificate block. Example: -----BEGIN CERTIFICATE-----......-----END CERTIFICATE-----
pvt_key string REQUIRED	Private key associated with the certificate, in PEM format. Required for certificates that use private/public key pairs. Account-level certificates are in PEM format. Example: -----BEGIN PRIVATE KEY-----\nMIIEvQIBADEFAASC...\n-----END PRIVATE

Example Request

This request adds a device-level PEM certificate to a Firebox in a WatchGuard Cloud account.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/system/certificates
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJjYjhVTzJlelpWaGZzVnZnYhGni-J2eJvbTn9ZwaRSAb9XT2CgVZX61UwZ9pQoMGpe4z620W56VOxQuxrTgjqGYHj5-K2oDCWhRWV7BANnUar6vguyGO4_M99Aht4kJlDZp482uMnY79ziK60_LRrnBPi6jPBalHVVfUOeykN_BT9foEDbO1-CTTGj-MC19ltkEX4gfODa9lqXw8lSzQ-SfXFHoCfFOflzYjXUQ_iAAL7lfw1WU31tAepmAa2YZ7M1LTOtIuP5ckHCqghlYNXafQ'
	-d '{
	"device": "12345",
	"name": "DeviceCert",
	"description": "", 
	"pem": "PEM String",
	"pvt_key": "Private Key String"
	}'

Add a certificate with a password-protected .PFX file to a Firebox in a WatchGuard Cloud account

device string integer REQUIRED	Required when you create or install device-level certificates. Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID of a standalone device can be a string or an integer. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345 or FB-12345. For FireClusters, specify the full device ID. For example, FBCL-12345. Example: FB-12345
name string REQUIRED	Name of the certificate. This can include only letters, numbers, spaces, parentheses "()", asterisks "*", periods ".", hyphens "-", and underscores "_". Maximum: 58 characters. Example: AccountCert
description string	Optional text description of the certificate. You can use the description to identify the purpose of the certificate. Example: My Account Certificate
pfx string REQUIRED	Certificate in .PFX format. Example: -----BEGIN PKCS12-----\nMIIG...==\n-----END PKCS12-----
password string REQUIRED	Password used to decrypt the .PFX file, if applicable. Required when the certificate is provided in PFX format and is encrypted. Example: M!cr0S3cur3#2025!

Example Request

This request adds a certificate with a password-protected .PFX file to a Firebox in a WatchGuard Cloud account.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/system/certificates
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJjYjhVTzJlelpWaGZzVnZnYhGni-J2eJvbTn9ZwaRSAb9XT2CgVZX61UwZ9pQoMGpe4z620W56VOxQuxrTgjqGYHj5-K2oDCWhRWV7BANnUar6vguyGO4_M99Aht4kJlDZp482uMnY79ziK60_LRrnBPi6jPBalHVVfUOeykN_BT9foEDbO1-CTTGj-MC19ltkEX4gfODa9lqXw8lSzQ-SfXFHoCfFOflzYjXUQ_iAAL7lfw1WU31tAepmAa2YZ7M1LTOtIuP5ckHCqghlYNXafQ'
	-d '{
	"device": "12345",
	"name": "MyDeviceCert", 
	"description": "",
	"pfx": "PFX String",
	"password": "Password for PFX decryption."
	}

Use an alias to add an existing account-level certificate to a Firebox in a WatchGuard Cloud account

alias
string
REQUIRED

User-defined name of an existing account-level certificate that was previously created or imported into your WatchGuard Cloud account. You can use GET/v1/configuration/{accountid}/system/certificates to return all account‑level certificates and aliases.
Example: YourAccountCert

device
string
integer
REQUIRED

Required when you create or install device-level certificates. Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID of a standalone device can be a string or an integer.
For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345 or FB-12345.

For FireClusters, specify the full device ID. For example, FBCL-12345.

Example: FB-12345

Example Request

This request uses an alias to add an existing account-level certificate to a Firebox in a WatchGuard Cloud account.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/system/certificates
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJjYjhVTzJlelpWaGZzVnZnYhGni-J2eJvbTn9ZwaRSAb9XT2CgVZX61UwZ9pQoMGpe4z620W56VOxQuxrTgjqGYHj5-K2oDCWhRWV7BANnUar6vguyGO4_M99Aht4kJlDZp482uMnY79ziK60_LRrnBPi6jPBalHVVfUOeykN_BT9foEDbO1-CTTGj-MC19ltkEX4gfODa9lqXw8lSzQ-SfXFHoCfFOflzYjXUQ_iAAL7lfw1WU31tAepmAa2YZ7M1LTOtIuP5ckHCqghlYNXafQ'
	-d '{
	"alias": "YourAccountCert",
	"device": "12345"
	}'

Example Response

The response returns the certificate object in JSON format:

                {
"account": "ACC-1234567",
"id": "crt_34425_jf3904ukdj94",
"device": "FB-12345",
"name": "DeviceCert",
"algorithm": "RSA",
"cert_type": "web_server",
"cert_fingerprint": "aa:aa:aa:aa:aa:aa:aa:aa",
"valid_from": 1738863038,
"expiration": 1815016892,
"key_length": 2048,
"signature_algo": "sha256WithRSAEncryption",
"key_usage": [
	"digital_signature",
	"content_commitment",
	"key_encipherment"
	],
"extended_key_usage": [
	"serverAuth"
	],
"issuer": "o=WatchGuard cn=WatchGuard Certificate Authority",
"subject": "o=myCompany cn=mydevice.org",
"subject_alt": [
	"mydevicealt.org"
	],
"pem": "-----BEGIN CERTIFICATE-----\nMIID...==\n-----END CERTIFICATE-----"
}

This table lists and describes the data returned in the response:

account string	WatchGuard Cloud account ID associated with the certificate.
id string	Unique identifier for the certificate object.
device string	Firebox device ID the certificate is associated with.
name string	Name of the certificate.
algorithm string	Algorithm used to generate the certificate.
cert_type string	Type of certificate.
cert_fingerprint string	Fingerprint of the certificate.
valid_from integer	Start of the certificate validity period (Unix time stamp).
expiration integer	End of the certificate validity period (Unix time stamp).
key_length integer	Length of the key in bits.
signature_algo string	Signature algorithm used.
key_usage array	List of key usage purposes.
extended_key_usage array	List of extended key usage purposes.
issuer string	Issuer of the certificate.
subject string	Subject of the certificate.
subject_alt array	Subject alternative names.
pem string	PEM-formatted public certificate string.

Install a Certificate to a Device

/{v1}/commands/{accountid}/system/certificates/install

Make a request to this endpoint to install a device-level certificate. You install a certificate to one or more Firebox devices so they can actively use it in the configuration.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

For example: WGC-1-123abc456 or ACC-1234567

Request Body

The information you must provide in the request body depends on the type of certificate installation:

Install a certificate, referenced by name, to a Firebox in a WatchGuard Cloud account

certificate
string
REQUIRED

Name of the certificate. The certificate must already be added to the Firebox.
Example: MyDeviceWebCert

device
string
integer
REQUIRED

For FireClusters, specify the full device ID. For example, FBCL-12345.

Example: FB-12345

Example Request

This request installs a certificate, referenced by name, to a specific Firebox in a WatchGuard Cloud account.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/commands/ACC-1234567/system/certificates/install
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJjYjhVTzJlelpWaGZzVnZnYhGni-J2eJvbTn9ZwaRSAb9XT2CgVZX61UwZ9pQoMGpe4z620W56VOxQuxrTgjqGYHj5-K2oDCWhRWV7BANnUar6vguyGO4_M99Aht4kJlDZp482uMnY79ziK60_LRrnBPi6jPBalHVVfUOeykN_BT9foEDbO1-CTTGj-MC19ltkEX4gfODa9lqXw8lSzQ-SfXFHoCfFOflzYjXUQ_iAAL7lfw1WU31tAepmAa2YZ7M1LTOtIuP5ckHCqghlYNXafQ'
	-d '{
	"certificate": "DeviceCert",
	"device": "12345"
	}'

Install a certificate, referenced by ID, to multiple Fireboxes in a WatchGuard Cloud account

certificate_id
string
REQUIRED

Unique identifier for the certificate. Make a GET request to the /{v1}/configuration/{accountid}/system/certificates endpoint to retrieve the certificate_id. Used when you reference the certificate in API calls or when you update or delete it. The certificate must have already been added to the Firebox.
Example: crt_45979_jf390cvdsert

devices
array
REQUIRED

Device IDs of the devices on which to install the certificate, separated by commas.

Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID of a standalone device can be a string or an integer. For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID can be 12345 or FB-12345.
For FireClusters, specify the full device ID. For example, FBCL-12345.

Example: 12345, 67890, 54321

Example Request

This request installs a certificate, referenced by ID, to multiple Fireboxes in a WatchGuard Cloud account.

                    curl -X POST https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/commands/ACC-1234567/system/certificates/install
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJjYjhVTzJlelpWaGZzVnZnYhGni-J2eJvbTn9ZwaRSAb9XT2CgVZX61UwZ9pQoMGpe4z620W56VOxQuxrTgjqGYHj5-K2oDCWhRWV7BANnUar6vguyGO4_M99Aht4kJlDZp482uMnY79ziK60_LRrnBPi6jPBalHVVfUOeykN_BT9foEDbO1-CTTGj-MC19ltkEX4gfODa9lqXw8lSzQ-SfXFHoCfFOflzYjXUQ_iAAL7lfw1WU31tAepmAa2YZ7M1LTOtIuP5ckHCqghlYNXafQ'
	-d '{
	"certificate_id": "crt_45979_jf390cvdsert",
	"devices": [ 
	"12345",
	"67890",
	"54321"
	 ]
	}'

Example Response

The response returns details of the installed certificate in JSON format:

                {
"account": "ACC-123456",
"children": [],
"confirmed_date": null,
"created": "2025-08-21T18:38:40Z",
"created_epoch": 1755520,
"data": "{\"xpath_request\": {\"version\": 1, \"transaction\": 
...
	    \"purpose\": \"ca\"}], \"final_cert\": true}",
"device": [12345],
"folder": null,
"group": null,
"id": "install_cert_123456rFa",
"job_id": null,
"model": "FireboxV-SM",
"name": "FireboxV_SM_J",
"operator": null,
"os_version": "12.11.3.B719894",
"parent": null,
"serial": "FVE1234567",
"start_date": "2025-08-21T18:38:40Z",
"start_date_epoch": 1751234520,
"status": "in_progress",
"template_initiated": false,
"timeout": 900,
"timeout_epoch": 1751234520,
"ttl": 175123420,
"type": "install_cert",
"version": null
}

This table lists and describes the data returned in the response:

account string	WatchGuard Cloud account ID.
children array	List of child objects.
confirmed_date string	Date when the action was confirmed.
created string	Creation time of the certificate.
created_epoch integer	Creation time in Unix epoch format.
data object	Associated data payload.
device string	Firebox device ID.
folder string	Folder name or path.
group string	Group identifier.
id string	Unique object ID.
job_id string	Job identifier for tracking.
model string	Device model name.
name string	Name of the object.
operator string	Operator who initiated the action.
os_version string	Operating system version.
parent string	Parent object reference.
serial string	Device serial number.
start_date string	Start date of the operation.
start_date_epoch integer	Start date in Unix epoch format.
status string	Current status of the operation.
template_initiated boolean	Indicates if initiated from a template.
timeout string	Timeout duration.
timeout_epoch integer	Timeout in Unix epoch format.
ttl integer	Time to live value.
type string	Type of the object.
version string	Version information.

Delete a Certificate

/{v1}/configuration/{accountid}/system/certificates/{objectid}

Make a request to this endpoint to delete a certificate from a WatchGuard Cloud account.

When you delete a certificate, you can no longer use the certificate for authentication. If you delete an automatically-generated certificate, your Firebox creates a new self-signed certificate with the same purpose the next time it reboots.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Identifies your WatchGuard Cloud account. You can view your accountId on the My Account page in WatchGuard Cloud.

For example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

Unique identifier for a certificate. Used when you reference the certificate in API calls or when you update or delete it.
To get the objectid, make a request to:
GET /v1/configuration/{accountid}/system/certificates

Example: crt_88910_ynqLebq5lcvnBUG

Example Request

This example deletes a certificate:

            curl -X DELETE https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-12345687/system/certificates/crt_88910_ynqLebq5lcvnBUG
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'

Example Response

The response returns details of the deleted certificate in JSON format:

                {
"account": "ACC-1234567",	
"akid": "BA:B3:71:40:5B:3B:24:4E:3C:C3:B3:9E:55:2D",
"algorithm": "EC",
"alias": "ACC-1234567/crt_tlb4t1pq4kKxc",
"author": "",
"author_username": "",
"cert_fingerprint": "56:81:7A:3B:BA:E0:23:59:AA:19:AA:F5:3B",
"cert_type": "ca",
"created": 1753387567,
"device": "12345",
"expiration": 1997604396,
"id": "crt_88910_ynqLlcvnBUG",
"inactive": true,
"inception_time": 1753387269,
"issuer": "c=cn st=sc l=cdc o=wg ou=vpn cn=jlh [email protected]",
"key_length": "256",
"key_usage": [
	"digital_signature",
	"key_cert_sign",
	"crl_sign"
	],
"metadata": {
	"tags": [
		"ca"
		]
	},
"name": "EC CA cert",
"object": "certificate",
"original_author": "7a6tuM0ax5FES2Q==",
"original_author_username": "TechP",
"pem": "-----BEGIN CERTIFICATE-----\nMIICStBO9pVwIhAOhO....MLppC70lXhjP8B\n-----END CERTIFICATE-----\n\n",
"pubkey_fingerprint": "CC:88:97:AC:B1:9B:33:08:AF",
"referencedby": [],
"references": [
	"ACC-1234567/crt_tlb4eC0t1pq4kKxc"
		],
"signature_algo": "ecdsa-with-SHA512",
"skid": "BA:B3:71:40:5B:3B:56:2E:93:C3:B3:9E:55:2D",
"subject": "c=cn st=sc l=cdc o=wg ou=vpn cn=jlh [email protected]",
"subject_name_fingerprint": "880A8123456BE775032F4",
"valid_from": 1682244396,
"version": 2
}

This table lists and describes the data returned in the response:

account string	Your WatchGuard Cloud account ID.
akid string	Authority Key Identifier.
algorithm string	Algorithm used to generate the certificate.
alias string	The name of an account certificate object.
author string	Author of the object. Always empty for objects added or updated with the Firebox Management API.
author_username string	User name of the author.
cert_fingerprint string	Fingerprint of the certificate.
cert_type string	Type of certificate.
created integer	Time that the object was created, specified in Unix epoch time format.
device string	WatchGuard Cloud Firebox device ID.
expiration integer	Unix epoch time when the certificate expires.
id string	Unique ID that identifies this object.
inactive boolean	Indicates whether the certificate is inactive.
inception_time integer	Unix epoch time when the certificate becomes valid.
issuer string	Issuer of the certificate.
key_length string	Length of the key.
key_usage array[string]	Key usages.
metadata object	Metadata associated with the certificate.
name string	Name of the certificate.
object string	Type of object.
original_author string	Original author of the object.
original_author_username string	User name of the original author.
pem string	PEM-encoded certificate string.
pubkey_fingerprint string	Fingerprint of the public key.
referencedby array[string]	Objects that reference this certificate.
references array[string]	References to this certificate.
signature_algo string	Signature algorithm used.
skid string	Subject Key Identifier.
subject string	Subject of the certificate.
subject_name_fingerprint string	Fingerprint of the subject name.
valid_from integer	Unix epoch time when the certificate becomes valid.
version integer	Version number of the certificate.

Get Certificates

/{v1}/configuration/{accountid}/system/certificates

/{v1}/configuration/{accountid}/system/certificates/{objectid}

Make a request to this endpoint to get certificates from a Firebox or WatchGuard Cloud account.

The information you must provide in the request depends on which certificates you want to retrieve:

Get all certificates from a WatchGuard Cloud account

Path Parameters

accountid
string
REQUIRED

Identifies your WatchGuard Cloud account. You can view your accountId on the My Account page in WatchGuard Cloud.

For example: WGC-1-123abc456 or ACC-1234567

Example Request

This request gets all certificates from a WatchGuard Cloud account.

                    curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/system/certificates
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'

Example Response

The response returns the retrieved certificate in JSON format:

                        {
"account": "WGC-1-123abc456",
"id": "crt_34425_jf3904ukdj94",
"device": "FB-123456",
"name": "MyDeviceWebCert",
"algorithm": "RSA",
"cert_type": "web_server",
"cert_fingerprint": "aa:aa:aa:aa:aa:aa:aa:aa",
"valid_from": 1738863038,
"expiration": 1815016892,
"key_length": 2048,
"signature_algo": "sha256WithRSAEncryption",
"key_usage": [
	"digital_signature",
	"content_commitment",
	"key_encipherment"
],
"extended_key_usage": [
	"serverAuth"
],
"issuer": "o=WatchGuard cn=WatchGuard Certificate Authority",
"subject": "o=myCompany cn=mydevice.org",
"subject_alt": [
	"mydevicealt.org"
	],
"pem": "pem_string"
}

This table lists and describes the data returned in the response:

account string	Your WatchGuard Cloud account ID.
id string	Unique ID that identifies this object.
device string	WatchGuard Cloud Firebox device ID.
name string	Name of the certificate.
algorithm string	Algorithm used to generate the certificate.
cert_type string	Type of certificate.
cert_fingerprint string	Fingerprint of the certificate.
valid_from integer	Unix epoch time when the certificate becomes valid.
expiration integer	Unix epoch time when the certificate expires.
key_length string	Length of the key.
signature_algo string	Signature algorithm used.
key_usage array[string]	Key usage information.
extended_key_usage array[string]	Extended key usages.
issuer string	Issuer of the certificate.
subject string	Subject of the certificate.
subject_alt string	Alternate subject of the certificate.
pem string	PEM-encoded certificate string.

Get all certificates from a specific Firebox in a WatchGuard Cloud account

Path Parameters

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Parameters

device
string
integer
REQUIRED

Required when creating or installing device-level certificates. Each device has a unique ID in WatchGuard Cloud, which appears in the URL of the Device Summary page. The device ID of a standalone device can be a string or an integer.
For example, if the Device Summary page URL is https://usa.cloud.watchguard.com/services/fb/device/FB-12345/summary, the device ID is 12345 or FB-12345.

For FireClusters, specify the full device ID. For example, FBCL-12345.

Example: FB-12345

Example Request

This request gets all certificates from a specific Firebox.

                    curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/system/certificates?device=12345
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabk...8AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'

Example Response

The response returns the retrieved certificate in JSON format:

                        {
"account": "WGC-1-123abc456",
"id": "crt_34425_jf3904ukdj94",
"device": "FB-123456",
"name": "MyDeviceWebCert",
"algorithm": "RSA",
"cert_type": "web_server",
"cert_fingerprint": "aa:aa:aa:aa:aa:aa:aa:aa",
"valid_from": 1738863038,
"expiration": 1815016892,
"key_length": 2048,
"signature_algo": "sha256WithRSAEncryption",
"key_usage": [
	"digital_signature",
	"content_commitment",
	"key_encipherment"
],
"extended_key_usage": [
	"serverAuth"
],
"issuer": "o=WatchGuard cn=WatchGuard Certificate Authority",
"subject": "o=myCompany cn=mydevice.org",
"subject_alt": [
	"mydevicealt.org"
	],
"pem": "pem_string"
}

This table lists and describes the data returned in the response:

account string	Your WatchGuard Cloud account ID.
id string	Unique ID that identifies this object.
device string	WatchGuard Cloud Firebox device ID.
name string	Name of the certificate.
algorithm string	Algorithm used to generate the certificate.
cert_type string	Type of certificate.
cert_fingerprint string	Fingerprint of the certificate.
valid_from integer	Unix epoch time when the certificate becomes valid.
expiration integer	Unix epoch time when the certificate expires.
key_length string	Length of the key.
signature_algo string	Signature algorithm used.
key_usage array[string]	Key usage information.
extended_key_usage array[string]	Extended key usages.
issuer string	Issuer of the certificate.
subject string	Subject of the certificate.
subject_alt string	Alternate subject of the certificate.
pem string	PEM-encoded certificate string.

Get a specific certificate from a WatchGuard Cloud account

Path Parameters

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can view your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

Example: crt_88910_ynqLebq5lcvnBUG

Example Request

This response gets a specific certificate from a WatchGuard Cloud account.

                    curl -X GET https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/system/certificates/crt_88910_ynqLebq5lcvn
	-H 'Accept: application/json'
	-H 'Content-Type: application/json'
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE5mM2FXTHhoSmEza0ltcEFMbnluT05DcFdIT2tZPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJjNDQyMTJlMi05MmI1LTRiOTYtYTRmNS1lYWRlODA4OTM1YjIiLCJjdXN0b206YXBpX2tleXMiOiJwMHM1UmQzUkF2NlR2d0VuWEx5YUphR2x0ZWtieEFVUzcwVGVzOXlGIiwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLXdlc3QtMi5hbWF6b25hd3MuY29tXC91cy13ZXN0LTJfa3hXeFdrTFZ5IiwiY29nbml0bzp1c2VybmFtZSI6IjAyNjk0OWM1OWI2NzIxOGNfcndfaWQiLCJhdWQiOiIzb3AybDBqazkxN3FudXFoZnVoanRvcXRzZyIsImV2ZW50X2lkIjoiODczM2ZmMjktOGNhMC00ODMyLTg0NzgtMDNiNWIxMDI3NmQ3IiwidG9rZW5fdXNlIjoiaWQiLCJhdXRoX3RpbWUiOjE1NjkzNTM0NDEsIm5hbWUiOiIwMjY5NDljNTliNjcyMThjX3J3X2lkIiwiY3VzdG9tOmFjY291bnRfaWQiOiJBQ0MtMTIzNTA2OCIsImV4cCI6MTU2OTM1NzA0MSwiY3VzdG9tOnJvbGUiOiIxIiwiaWF0IjoxNTY5MzUzNDQxfQ.MUAeG6QyM7Zog8mM--WK2uJVevLRwz8z2KPpGhQbUnHK04Hy_JdO4F4wH6IV0WVENGsBrcjp5boxcBZgdJE46123MGnB0HvghN5IoAZUOkfFPm7SAN68posHqYLoo14YNedc5GtvOzCxTmi9YepvE5LhsoC6Tgyc0e3ABn18gEZsyxmJFcMBHXOMei7AssYSWAdDyoI7j6jZslxmhXj7_h6T9PyqjLxLjFEq5S6oK9u4IVDVBlRxbURaRVAGb7ywfHiZEPDgceV-Wnv0AIhDzj5dL28AmiGIkWtWinF0UD-NSMKN4vtszK2sUWUSl8ZfVNGU650heiAaUAy7XmiqbA'

Example Response

The response returns the retrieved certificate in JSON format:

                        {
"account": "WGC-1-123abc456",
"id": "crt_34425_jf3904ukdj94",
"device": "FB-123456",
"name": "MyDeviceWebCert",
"algorithm": "RSA",
"cert_type": "web_server",
"cert_fingerprint": "aa:aa:aa:aa:aa:aa:aa:aa",
"valid_from": 1738863038,
"expiration": 1815016892,
"key_length": 2048,
"signature_algo": "sha256WithRSAEncryption",
"key_usage": [
	"digital_signature",
	"content_commitment",
	"key_encipherment"
],
"extended_key_usage": [
	"serverAuth"
],
"issuer": "o=WatchGuard cn=WatchGuard Certificate Authority",
"subject": "o=myCompany cn=mydevice.org",
"subject_alt": [
	"mydevicealt.org"
	],
"pem": "pem_string"
}

This table lists and describes the data returned in the response:

account string	Your WatchGuard Cloud account ID.
id string	Unique ID that identifies this object.
device string	WatchGuard Cloud Firebox device ID.
name string	Name of the certificate.
algorithm string	Algorithm used to generate the certificate.
cert_type string	Type of certificate.
cert_fingerprint string	Fingerprint of the certificate.
valid_from integer	Unix epoch time when the certificate becomes valid.
expiration integer	Unix epoch time when the certificate expires.
key_length string	Length of the key.
signature_algo string	Signature algorithm used.
key_usage array[string]	Key usage information.
extended_key_usage array[string]	Extended key usages.
issuer string	Issuer of the certificate.
subject string	Subject of the certificate.
subject_alt string	Alternate subject of the certificate.
pem string	PEM-encoded certificate string.