Create a Certificate Signing Request (CSR) in WatchGuard Cloud

Applies To: Cloud-managed Fireboxes, Locally-managed Fireboxes

Use a certificate signing request (CSR) to obtain a signed certificate from a Certificate Authority (CA).

You can generate a CSR from WatchGuard Cloud for your Firebox and submit it to a Certificate Authority (CA) to obtain a signed certificate. You can also use the Let's Encrypt service to request a certificate from WatchGuard Cloud.

Standard CSR requests are available at both the account and device levels in WatchGuard Cloud. The Let's Encrypt certificate service is available only at the device level for cloud-managed Fireboxes and locally-managed Fireboxes connected to WatchGuard Cloud.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have Account Administration permissions to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.

CSRs created for your account can only be imported at account level. CSRs created for a device can only be imported at device level.

Create a Certificate Signing Request (CSR)

You can create a standard CSR at the account or device level in WatchGuard Cloud.

To create a CSR for your account, go to Administration > Certificates. To create a CSR for a cloud-managed device, select the device and go to Device Configuration > Device Certificates.

To create a CSR:

  1. Select the CSR tab.
  2. Click Create CSR.

Screenshot of the CSR tab on the Certificates page

  1. On the Specify Subject Name page, enter these certificate request details:
  2. Common Name (CN) — The fully qualified domain name of the device you want to secure, such as host.example.com.
  3. Department Name (OU) — The OU (Organizational Unit) that the device belongs to, such as IT or Sales.
  4. Company Name (O) — TEnter the company name.
  5. City/Location (L) — The city or location where the device is located.
  6. State/Province (ST) — Tthe two-character state or province code where the device is located.
  7. Country (C) — The two-character country code where the device is located.

Screenshot of the Specify Subject Name page for a CSR, at device level

  1. Click Next.
  2. On the Specify Domain page, from the Type drop-down list, select the type of certificate request.

    3. Enter these details:

    • DNS Name — The DNS name of the device you want to secure, such as host.example.com.
    • IP Address — The IP address of the device you want to secure.

    The IP Address text box appears when you create a CSR from the Device Certificates page.

    • Email address — The email address associated with your request.

Screenshot of the Specify Domain page for a CSR

  1. Click Next.
  2. On the Select the Encryption and Key Usage page, select the Algorithm, Key Length, and Key Usage. By default, the certificate uses RSA encryption, 4096-bit key length, and both encryption and signatures for key usage.

Screenshot of the Encryption and Key Usage page for a CSR

  1. Click Next.
    The Finish page opens.

Screenshot of the Finish page for a CSR

  1. Click Download CSR and save the file on your computer.
  2. Send this CSR to a certificate authority (CA) to obtain a signed certificate.
  3. Click Done.
  4. Select the CSR tab to view your CSR in the list. When you receive the signed certificate, the pending CSR is removed from this list.

Next Steps

After you receive the signed certificate from the CA, you can add it to WatchGuard Cloud or a specific device. For more information, go to Add a Certificate.

Request a Let's Encrypt Certificate

To use this feature, your Firebox must run Fireware v2026.4 or higher. Fireware 2026.4 is supported on these models: Firebox M Series M4850, M5850, M6850, M695, M595, M495, M395, and M295, and Firebox T Series T185, T175, T145, T125, and T115.

Use the Let's Encrypt service to request certificates from WatchGuard Cloud as an alternative to the standard CSR workflow. Let's Encrypt automatically renews certificates before they expire, with no user action required. Unlike standard CSR requests, Let's Encrypt does not require subject name information such as Company Name, Department Name, City/Location, State/Province, or Country. You can request Let's Encrypt certificates for cloud-managed Fireboxes and locally-managed Fireboxes connected to WatchGuard Cloud. Follow the procedure for your Firebox management type.

The Let's Encrypt certificate service is not available from Administration > Certificates. The Firebox must communicate directly with Let's Encrypt to validate the domain and obtain the certificate.

Request a Let's Encrypt Certificate for a Cloud-Managed Firebox

Screenshot of the Device Certificates page for a cloud-managed Firebox

To request a certificate with Let's Encrypt for a cloud-managed Firebox:

  1. Select Configure > Devices.
  2. Select the cloud-managed Firebox.
  3. Select Device Configuration > Device Certificates.
  4. Select the CSR tab.
  5. Click Create CSR.
  6. From the Encryption Service drop-down list, select Let's Encrypt.
  7. Select the I Have Read the Let's Encrypt Terms and Conditions check box.
  8. Click Next.

Screenshot of the Let's Encrypt option in the Create CSR Wizard, cloud-managed Firebox

  1. On the Specify Domain page, in the DNS Name text box, enter the fully qualified domain name (FQDN) of the device you want to secure, such as host.example.com.

Screenshot of the Specify Domain page in the Let's Encrypt workflow, cloud-managed Firebox

  1. Click Next.
  2. On the Select the Encryption page, select the Algorithm and Key Length. By default, the certificate uses RSA encryption, 4096-bit key length.

Screenshot of the Select the Encryption page in the Let's Encrypt workflow, cloud-managed Firebox

  1. Click Next.
    The Finish page opens.
  2. On the Finish page, click Done.

Screenshot of the Finish page in the CSR Let's Encrypt workflow, cloud-managed Firebox

WatchGuard Cloud sends the certificate request to the Firebox. The Firebox communicates directly with Let's Encrypt to obtain and renew the certificate. After Let's Encrypt issues the certificate, it appears in the certificate list. The certificate type includes (ACME) in parentheses.

Request a Let's Encrypt Certificate for a Locally-Managed Firebox Connected to WatchGuard Cloud

Screenshot of the Device Certificates page for a locally-managed Firebox

To request a certificate with Let's Encrypt for a locally-managed Firebox connected to WatchGuard Cloud:

  1. Select Configure > Devices.
  2. Select the locally-managed Firebox.
  3. Select Device Certificates.
  4. Select the ACME CSR tab.
  5. Click Create CSR.
  6. From the Encryption Service drop-down list, select Let's Encrypt.
  7. Select the I Have Read the Let's Encrypt Terms and Conditions check box.
  8. Click Next.

Screenshot of the Let's Encrypt option in the Create CSR Wizard, locally-managed Firebox

  1. On the Specify Domain page, in the DNS Name text box, enter the fully qualified domain name (FQDN) of the device you want to secure, such as host.example.com.

Screenshot of the Specify Domain page in the Let's Encrypt workflow, locally-managed Firebox

  1. Click Next.
  2. On the Select the Encryption page, select the Algorithm and Key Length. By default, the certificate uses RSA encryption, 4096-bit key length.

Screenshot of the Select the Encryption page in the Let's Encrypt workflow, locally-managed Firebox

  1. Click Next.
    The Finish page opens.
  2. On the Finish page, click Done.

Screenshot of the Finish page in the CSR Let's Encrypt workflow, locally-managed Firebox

WatchGuard Cloud sends the certificate request to the Firebox. The Firebox communicates directly with Let's Encrypt to obtain and renew the certificate. After Let's Encrypt issues the certificate, it appears in the certificate list. The certificate type includes (ACME) in parentheses.

For locally-managed Fireboxes connected to WatchGuard Cloud, click Sync on the Certificates tab to retrieve certificates from the Firebox and update the certificate list in WatchGuard Cloud.

Screenshot of the Device Certificates page for a locally-managed Firebox, Sync button

Related Topics

Manage Certificates in WatchGuard Cloud

Configure the Web Server Certificate for Firebox Authentication in WatchGuard Cloud

Import and Install a Third-Party Web Server Certificate