Contents

Manage Device Certificates (WSM)

In Firebox System Manager, you can:

  • See a list of the current Firebox certificates and their properties
  • Update the trusted CA certificates
  • Delete a certificate from the device
  • Export a certificate for re-signing or distribution
  • Import a certificate or certificate revocation list (CRL)

When you import, update, or delete a certificate on a FireCluster member, the change automatically synchronizes to the other FireCluster member. You do not need to import separate certificates for FireCluster members.

View Certificates

To see the current list of certificates:

  1. Open Firebox System Manager.
  2. Select View > Certificates.
    The Certificates dialog box appears.

Screen shot of the Certificates dialog box

In this dialog box, you can see a list of all certificates and certificate signing requests (CSRs). The list includes:

  • The status and type of the certificate
  • The algorithm used by the certificate (EC, RSA, or DSS)
  • The subject name or identifier of the certificate

To filter the display based on certificate type, click the Show drop-down list. To sort the list, click on any column header.

  1. To see additional information about a certificate in the list, select the certificate and click Details.
    The Certificate Details dialog box appears. You can see which CA signed the certificate and the certificate fingerprint. You can use this information to troubleshoot or uniquely identify certificates.

screenshot of the Certificate Details page

Update Trusted CA Certificates

Your Firebox can automatically get new versions of the trusted CA certificates stored on the Firebox and automatically install the new certificates. This update makes sure that all the trusted CA certificates on your Firebox are the latest version. Any expired certificates are updated, and new trusted CA certificates are added to your device. The updated certificates are downloaded from a secure WatchGuard server. The Firebox checks for updates every 48 hours.

To enable automatic updates:

  1. Open Policy Manager and then select Setup > Certificates.

Screen shot of the update Trusted CA certificates page in WSM

  1. Select the Enable automatic update of trusted CA certificates check box.
  2. Click OK.

Delete a Certificate

When you delete a certificate, it can no longer be used for authentication. If you delete one of the automatically generated certificates, such as the self-signed certificate used by default for the proxy, your Firebox creates a new self-signed certificate for this purpose the next time it reboots. The Firebox does not create a new self-signed certificate automatically if you have imported a different certificate.

The Proxy Authority certificate must not be deleted and left with no certificate. The Firebox automatically replaces the missing certificate with a default certificate if the Firebox restarts.

Export a Certificate

You can export a certificate for re-signing by a trusted CA, or for distribution to clients on your network.

  1. Select a certificate and click Export.
  2. Select a location and type a name for the certificate.
    The certificate is saved in PEM format.

Import a CRL

You can import a certificate revocation list (CRL) that you have previously downloaded from your local computer. CRLs are used only to verify the status of certificates used for VPN authentication. Certificates must be in PEM (base64) encoded format.

  1. Click Import CRL.

screenshot of the Import a CRL tab page

  1. Click Browse and find the file and then click OK.
  2. In the User Name and Passphrase text boxes, type the credentials for a user account with Device Administrator (read/write) privileges.
  3. Click OK.
    The CRL you specified is appended to the CRL on your device.

Import a Certificate

You can import a certificate from the Windows clipboard, or from a file on your local computer. Certificates must be in Base64 PEM encoded format or PFX file format.

Before you import a certificate to use with the proxy content inspection feature, you must import each previous certificate in the chain of trust of the type General Use. Start with the root CA certificate and proceed to the end entity certificate, in that order.

To import a CA certificate for your Firebox to use to validate other certificates when they are imported and create a chain of trust, make sure to select the General Use category when you import the CA certificate and do not include the private key.

About PFX Files

A PFX certificate bundle contains all the required certificates and private key, and is uploaded as a single file.

To use a PFX bundle for HTTPS content inspection, you must have two PFX files:

  • The first proxy authority PFX file must have the root CA certificate that issued the proxy authority certificate, and the proxy authority certificate with its private key.
  • The second proxy server PFX file must have the root CA certificate that issued the proxy server certificate, and the proxy server certificate with its private key.

About Certificate Functions

General Use — Select this option for root or intermediate CA certificates, VPN tunnel, web server, or other certificates.

Proxy Authority (re-signing CA certificate for outbound content inspection) — Select this option if the certificate is for a proxy policy that manages web traffic requested by users on trusted or optional networks from a web server on an external network. A certificate you import for this purpose must be a CA certificate. Before you import the CA certificate used to re-encrypt traffic with a proxy, make sure the CA certificate used to sign this certificate was imported with the General Use category.

Proxy Server (server certificate for inbound content inspection) — Select this option if the certificate is for a proxy policy that manages web traffic requested by users on an external network from a web server protected by the Firebox. Before you import the proxy server certificate used to re-encrypt traffic from a web server, make sure the CA certificate used to sign this certificate was imported with the General Use category.

For more information, see About Certificates and Use Certificates with HTTPS Proxy Content Inspection.

Import Certificate with Firebox System Manager

See Also

About Certificates

Create a Certificate CSR

Manage Certificates on the Management Server

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search