Create a Certificate CSR

You can create a certificate signing request (CSR) from your Firebox with Fireware Web UI or Firebox System Manager (FSM). To create a self-signed certificate, you add part of a cryptographic key pair in a CSR and send the request to a Certificate Authority (CA). The CA issues a certificate after the CA receives the CSR and verifies your identity.

If you have FSM or Management Server software installed, you can use these programs to create a CSR for your Firebox. You can also use other tools, such as OpenSSL or the Microsoft CA Server that comes with most Windows Server operating systems. For more information, see Create a CSR with OpenSSL or Sign a Certificate with Microsoft CA. You can also create a new certificate for Mobile VPN with the built-in Certificate Authority (CA) Manager on your Management Server.

We recommend that you use third-party software to generate the CSR. This allows the certificate to be used on another Firebox if you upgrade to a newer model, migrate to another Firebox, or return the Firebox for an RMA replacement.

If you do not have a CA set up in your organization, we recommend that you choose a prominent CA to sign the CSRs you use, except for the Proxy Authority certificate. If a prominent CA signs your certificates, your certificates are automatically trusted by most users. You can also import additional certificates so that your Firebox trusts other CAs.

Proxy Authority Certificates and CSRs

To create a proxy authority certificate for use with the HTTPS-proxy content inspection feature, you must create a CA certificate that can re-sign other certificates. If you create a CSR and have it signed by a prominent CA, it cannot be used as a re-signing CA certificate for content inspection. We recommend that you use the Firebox default proxy authority certificate, or a certificate signed by your own internal CA. For example, if your organization uses Microsoft Active Directory Certificate services, you can use it to sign the certificate so that it will be trusted by clients in your organization. For more information, go to Use Certificates with Outbound HTTPS Proxy Content Inspection.

  1. Select System > Certificates.
  2. Click Create CSR.
    The CSR Wizard starts.

Screen shot of the CSR Wizard - Introduction page

  1. Click Next.
  2. Select the purpose of the completed certificate.

Screen shot of CSR Wizard - Choose Certificate Function page

  1. If the certificate will be used to re-encrypt inspected content with an HTTPS proxy, select Proxy Authority.
  2. If the certificate will be used to re-encrypt content for a protected web server with an HTTPS proxy, select Proxy Server.
  3. For all other uses, including VPN, Firebox, or Management Server authentication, select General Use.
  4. Click Next.
  5. Type these certificate request details:
  • Name (CN) — The CN (Common Name) is the fully qualified domain name of the device you want to secure, such as host.example.com.
  • Department Name (OU) — Type the OU (Organizational Unit) that the device belongs to. For example, IT or Sales.
  • Company Name (O) — Type the company name that the device belongs to.
  • City/Location (L) — Type the city or location where the device is located.
  • State/Province (ST) — Type the two-character state or province code where the device is located.
  • Country (C) — Type the two-character country code where the device is located.

Screen shot of CSR Wizard - Certificate details page

  1. Click Next.
    The wizard creates a subject name based on the information you entered on the previous page.
  2. Type the appropriate domain information:
  • Subject Name — The Subject Name is completed automatically with information from the previous step.
  • DNS Name — The DNS name of the device you want to secure, such as host.example.com.
  • IP Address — The IP address of the device you want to secure.
  • User Domain Name — The administrator email address for the device domain.

Screen shot of CSR Wizard - Domain information page

  1. Click Next.
  2. Select the encryption, key length, and key usage. By default, the certificate uses RSA encryption, 3072-bit key length, and both encryption and signatures for key usage.

HTTPS proxy authority and HTTPS proxy server certificates do not have options for key usage.

Screen shot of CSR Wizard - Key Length and Usage page

  1. Click Next.
  2. The generated CSR is displayed.

Screenshot of CSR Wizard - Completed page

You must send this CSR to a certificate authority (CA) for signing before you can use it with your Firebox.

For a proxy authority certificate for HTTPS content inspection, you cannot use a public CA because public CA providers do not provide a CA certificate with permission to sign other certificates. We recommend you use an internal CA in your organization.

When you import the finished certificate, you must first import the CA certificate used to sign the new certificate with the General Use category.

  1. Click Finish & Import to import a certificate.
    The Import Certificate dialog box opens.
  2. Click Finish to close the wizard.
  1. Start Firebox System Manager for your Firebox.
  2. Select View > Certificates.
  3. Click Create CSR.
    The CSR Wizard starts.

Screen shot of CSR Wizard - Introduction page

  1. Click Next.
  2. Select the purpose of the completed certificate.

Screen shot of CSR Wizard - Purpose of certificate page

  1. If the certificate will be used to re-encrypt inspected content with an HTTPS proxy, select Proxy Authority.
  2. If the certificate will be used to re-encrypt content for a protected web server with an HTTPS proxy, select Proxy Server.
  3. For all other uses, including VPN, Firebox, or Management Server authentication, select General Use.
  1. Click Next.
  2. Type these certificate request details:
  • Name (CN) — The CN (Common Name) is the fully qualified domain name of the device you want to secure, such as host.example.com.
  • Department Name (OU) — Type the OU (Organizational Unit) that the device belongs to. For example, IT or Sales.
  • Company Name (O) — Type the company name that the device belongs to.
  • City/Location (L) — Type the city or location where the device is located.
  • State/Province (ST) — Type the two-character state or province code where the device is located.
  • Country (C) — Type the two-character country code where the device is located.

Screenshot of Certificate Request Wizard

  1. Click Next.
    The wizard creates a subject name based on the information you entered in the previous screen.
  2. Type the appropriate domain information:
  • Subject Name — The Subject Name is completed automatically with information from the previous step.
  • DNS Name — The fully qualified domain name of the device you want to secure, such as host.example.com.
  • IP Address — The IP address of the device you want to secure.
  • User Domain Name — The administrator email address for the device domain.

Screenshot of Certificate Request Wizard

  1. Click Next.
  2. Select the encryption, key length, and key usage. By default, the certificate uses RSA encryption, 3072-bit key length, and both encryption and signatures for key usage. Click Next.

HTTPS proxy authority and HTTPS proxy server certificates do not have options for key usage.

Screenshot of the Certificate Request Wizard, specify algorithm, key length, and key usage screen

  1. Click Next.
  2. Type the credentials for a user account with Device Administrator (read/write) privileges.
  3. Click OK to see the generated CSR.

Screenshot of completed Certificate Request Wizard

  1. Click Copy to copy the Certificate Signing Request to the Windows clipboard.

You must send this CSR to a certificate authority (CA) for signature before you can use it with your Firebox.

For a proxy authority certificate for HTTPS content inspection, you cannot use a public CA because public CA providers do not provide a CA certificate with permission to sign other certificates. We recommend you use an internal CA in your organization.

When you import the finished certificate, you must first import the CA certificate used to sign the new certificate with the General Use category.

  1. Click Next.
  2. On the last page of the wizard, you can:
  3. Click Import Now to import a certificate.
    The Import Certificate dialog box opens.
    For more information about this dialog box, see Manage Device Certificates (WSM).
  4. Click Finish to close the wizard.

To connect to CA Manager:

  1. Open WatchGuard System Manager and connect to the Management Server.
    You must type the configuration passphrase to connect.
  2. Select the Device Management tab for the Management Server.
  3. Click Certificate Authority icon.
    Or, select Tools > CA Manager.
    Or, connect directly to WatchGuard WebCenter at https://<IP address of the Management Server>:4130.

To create a new certificate:

  1. From the CA MANAGER section, select Generate.
    The Generate a New Certificate page opens.

Screen shot of the Generate a New Certificate page

  1. Type the common name, password, and certificate lifetime for the subject.
    • For Firebox Authentication users, the common name must match the identification information for the Firebox (usually, the Firebox IP address).
    • For a generic certificate, the common name is the name of the user.
  2. To download the certificate after it is generated, select the Download Cert check box.
  3. Click Generate.

When you use Firebox System Manager to create a certificate signing request, your Firebox also creates a private key. It is not possible to export this private key from your device. If you want to use the server certificate for a different device, you will need this private key to import the certificate. For an alternative method to create a certificate signing request and private key, go to Create a CSR with OpenSSL.

Related Topics

About Certificates

Manage Certificates on the Management Server

Connect to WatchGuard WebCenter