# Replace an expiring SSL certificate on a SonicWall (SSL VPN and management)

A renewed certificate does nothing until the SonicWall has imported it and
each service has been switched to it. This runbook covers SonicOS 7.x, with
notes for 6.5 and the SMA 100 series. Plan a maintenance window: SonicWall's
documentation asks for a reboot after importing certificates.

## 1. Prepare a PKCS #12 file

SonicOS imports a server certificate with its private key as **PKCS #12**
(`.p12`/`.pfx`) only. If your CA gave you separate PEM files, combine them:

```
openssl pkcs12 -export -out vpn.p12 -inkey server.key -in server.crt
```

OpenSSL asks for an export password; you'll need it for the import. Keys must
be RSA.

## 2. Import the certificate and its chain

1. **Device | Settings > Certificates > Import.**
2. Choose the local certificate option, enter a **Certificate Name** and the
   **Certificate Management Password** (the `.p12` password), add the file and
   click **Import**.
3. Import the **intermediate** certificate (and the root if needed) with the
   same dialog, using the CA certificate option: a PKCS #7 (`.p7b`) or DER
   (`.der`/`.cer`) file.
4. Reboot the firewall when the documentation for your model requires it.

The imported certificate should not show **Validated: No**. If it does, part
of the chain is missing.

On SonicOS 6.5 the menus are laid out differently; the steps are the same.

## 3. Select it for each service

**SSL VPN (NetExtender, Virtual Office):** **Network > SSL VPN > Server
Settings > Certificate Selection.** The default is a self-signed certificate on
port 4433. On 6.5: **Manage | Connectivity | SSL VPN | Server Settings.**

**HTTPS management:** **Device | Settings > Administration > Management.**
In **Certificate Selection** choose the imported certificate and set
**Certificate Common Name** to the FQDN you browse to. On 6.5: **Manage |
Appliance | Base Settings.**

Click **Accept** in each section, or the change isn't saved.

## 4. Check it from outside

```
openssl s_client -connect vpn.example.com:4433 -servername vpn.example.com -showcerts </dev/null
```

Use port 443 (or your management port) for the admin interface. Check the
expiry date and that the intermediate is sent. Keep the old certificate until
the new one works, so you can switch back.

## Common problems

- **"Validated: No" or browser trust warnings:** the intermediate or root
  isn't imported. Import it as a CA certificate, then reboot.
- **"Web-management certificate name does not match":** the common name was
  changed but the certificate or its chain isn't fully imported.
- **Certificate errors right after switching:** select the self-signed
  certificate, Accept, then select the imported one again.
- **Locked out of the web UI with SSL_ERROR_HANDSHAKE_FAILURE_ALERT:**
  **Enable Client Certificate Check** is on. Turn it off over SSH.
- **The `.p12` import fails** although the password is right: OpenSSL 3
  encrypts PKCS #12 files with newer algorithms by default, which older
  firmware may not accept. Re-export with `openssl pkcs12 -export -legacy ...`
  and try again.

## Let the SonicWall renew it: ACME

**SonicOS 7.3.4** (build 7.3.4-7013, October 2026) adds ACME support, so the
firewall can request, renew and install Let's Encrypt certificates itself.
Earlier Gen 7 firmware doesn't have it. SonicWall's step-by-step guide is
written for SonicOS 8; check the 7.3.4 release notes for your build.

In SonicOS 8: **Device | Settings > Certificates > Create > Automatically
Provision Certificate (ACME)**, then select or create a CSR whose common name
is a public FQDN.

Requirements and limits:

- Public DNS for the name points at the firewall's WAN address.
- Inbound TCP 80 reaches the firewall (HTTP-01 validation): not blocked by
  access rules or Geo-IP, and not NATed to another device.
- No wildcards, internal names or IP addresses.
- Renewal is automatic and needs no reboot, but each renewal repeats the port
  80 check.

## SMA 100 series

**System > Certificates > Server Certificates > Import Certificate.** Upload a
`.zip` containing `server.crt` and `server.key` (PEM) at the top level of the
archive, add intermediates under **Additional CA Certificates**, then restart.

## Check your domain

The free scan finds every certificate issued for your domain in the CT logs
and flags hosts that still serve an older one after a renewal. See also
[Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## Sources

- [SonicWall: importing a local certificate (SonicOS 7.3)](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7.3-device_settings/Content/Certificates/certificates-authority-importing.htm)
- [SonicWall: creating a PKCS #12 file (SonicOS 7.3)](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7.3-device_settings/Content/Certificates/certificates-pkcs-creating.htm)
- [SonicWall: SSL VPN server settings (SonicOS 7.3)](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7-3-ssl_vpn/Content/ssl-vpn-configuring-server.htm)
- [SonicWall: selecting a security certificate for management](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7.3-device_settings/Content/Management/security-certificate-selecting.htm)
- [SonicWall KB: certificate validation and browser trust warnings](https://www.sonicwall.com/support/knowledge-base/troubleshooting-sonicwall-ssl-certificate-validation-and-browser-trust-warnings/kA1VN000001xK6z0AE)
- [SonicWall KB: web UI unreachable after importing a certificate](https://www.sonicwall.com/support/knowledge-base/unable-to-access-the-web-ui-after-importing-a-certificate-ssl-error-handshake-failure-alert/170504310124081/)
- [SonicOS 7.3.4 release notes](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7.3-release_notes/Content/sonicos-7-3-4-7013.htm)
- [SonicWall KB: ACME on SonicOS 8.2.2](https://www.sonicwall.com/support/knowledge-base/automated-certificate-management-environment-acme-on-sonicos-8-2-2-8015/kA1VN000001ww330AA)

---
Source: https://nameward.app/guides/sonicwall-replace-ssl-certificate (updated 2026-10-29)