SonicWall: import and replace an SSL certificate

A renewed certificate does nothing until the SonicWall has imported it and each service has been switched to it. This runbook covers SonicOS 7.x, with notes for 6.5 and the SMA 100 series. Plan a maintenance window: SonicWall's documentation asks for a reboot after importing certificates.

1. Prepare a PKCS #12 file

SonicOS imports a server certificate with its private key as PKCS #12 (.p12/.pfx) only. If your CA gave you separate PEM files, combine them:

openssl pkcs12 -export -out vpn.p12 -inkey server.key -in server.crt

OpenSSL asks for an export password; you'll need it for the import. Keys must be RSA.

2. Import the certificate and its chain

Device | Settings > Certificates > Import.
Choose the local certificate option, enter a Certificate Name and the Certificate Management Password (the .p12 password), add the file and click Import.
Import the intermediate certificate (and the root if needed) with the same dialog, using the CA certificate option: a PKCS #7 (.p7b) or DER (.der/.cer) file.
Reboot the firewall when the documentation for your model requires it.

The imported certificate should not show Validated: No. If it does, part of the chain is missing.

On SonicOS 6.5 the menus are laid out differently; the steps are the same.

3. Select it for each service

SSL VPN (NetExtender, Virtual Office): Network > SSL VPN > Server Settings > Certificate Selection. The default is a self-signed certificate on port 4433. On 6.5: Manage | Connectivity | SSL VPN | Server Settings.

HTTPS management: Device | Settings > Administration > Management. In Certificate Selection choose the imported certificate and set Certificate Common Name to the FQDN you browse to. On 6.5: Manage | Appliance | Base Settings.

Click Accept in each section, or the change isn't saved.

4. Check it from outside

openssl s_client -connect vpn.example.com:4433 -servername vpn.example.com -showcerts </dev/null

Use port 443 (or your management port) for the admin interface. Check the expiry date and that the intermediate is sent. Keep the old certificate until the new one works, so you can switch back.

Common problems

"Validated: No" or browser trust warnings: the intermediate or root isn't imported. Import it as a CA certificate, then reboot.
"Web-management certificate name does not match": the common name was changed but the certificate or its chain isn't fully imported.
Certificate errors right after switching: select the self-signed certificate, Accept, then select the imported one again.
Locked out of the web UI with SSL_ERROR_HANDSHAKE_FAILURE_ALERT: Enable Client Certificate Check is on. Turn it off over SSH.
The .p12 import fails although the password is right: OpenSSL 3 encrypts PKCS #12 files with newer algorithms by default, which older firmware may not accept. Re-export with openssl pkcs12 -export -legacy ... and try again.

Let the SonicWall renew it: ACME

SonicOS 7.3.4 (build 7.3.4-7013, October 2026) adds ACME support, so the firewall can request, renew and install Let's Encrypt certificates itself. Earlier Gen 7 firmware doesn't have it. SonicWall's step-by-step guide is written for SonicOS 8; check the 7.3.4 release notes for your build.

In SonicOS 8: Device | Settings > Certificates > Create > Automatically Provision Certificate (ACME), then select or create a CSR whose common name is a public FQDN.

Requirements and limits:

Public DNS for the name points at the firewall's WAN address.
Inbound TCP 80 reaches the firewall (HTTP-01 validation): not blocked by access rules or Geo-IP, and not NATed to another device.
No wildcards, internal names or IP addresses.
Renewal is automatic and needs no reboot, but each renewal repeats the port 80 check.

SMA 100 series

System > Certificates > Server Certificates > Import Certificate. Upload a .zip containing server.crt and server.key (PEM) at the top level of the archive, add intermediates under Additional CA Certificates, then restart.

Check your domain

The free scan finds every certificate issued for your domain in the CT logs and flags hosts that still serve an older one after a renewal. See also Certificate renewed but not installed.

Replace an expiring SSL certificate on a SonicWall (SSL VPN and management)