Sophos Firewall keeps serving the old certificate until you upload the renewed one and select it in each place that uses it. This runbook covers SFOS 21 and 22; the menu paths are the same in both.
1. Upload the certificate and its chain
- Certificates > Certificates > Add. Action: Upload certificate.
- Enter a name and choose the format: PKCS #12 (
.pfx/.p12, key included) or PEM (certificate and private key as separate files). - Select the files, enter the passphrase (30 characters at most) and Save.
- Upload the intermediate certificate under Certificates > Certificate authorities > Add, and the root if your CA requires it. For a root CA, set Use certificate for to Validation only.
In the certificate list, the Trusted column should show a green check.
Keep the firewall clock correct (NTP). A wrong time can make imports fail.
2. Assign it
Admin console and portals: Administration > Admin and user settings, section Admin console and end-user interaction, field Certificate. This one setting covers the web admin console, the user portal, the VPN portal and the captive portal. Click Apply.
SSL VPN (remote access): Remote access VPN > SSL VPN > SSL VPN global settings > SSL server certificate. If an intermediate CA issued the certificate, make sure the intermediate and root are uploaded too.
Web server protection (WAF): Rules and policies > Firewall rules, open each rule whose action is Protect with web server protection, and select the new certificate in its HTTPS settings. Two things to know:
- The certificate's names replace the rule's Domains list, so check it after saving.
- Saving restarts the WAF rules and drops current connections.
3. Tell VPN users
- Sophos Connect users click Update policy in the client, or reimport the provisioning file.
- Users with a manually imported
.ovpnfile download and import a fresh copy from the VPN portal. - Site-to-site SSL VPN: download the server configuration again and upload it to the client firewall.
4. Check it from outside
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null
Check the expiry date and that the intermediate is sent. Repeat for the WAF hostnames and the SSL VPN port if it differs.
Common problems
- The old certificate can't be deleted: something still uses it. Change every assignment above first.
- Untrusted or incomplete chain: upload the intermediate (and root) under Certificate authorities.
- WAF hostnames stopped matching: the Domains list was replaced by the certificate's names. Correct it in the rule.
Let the firewall renew it: Let's Encrypt
Since SFOS 21.0 the firewall can request and renew Let's Encrypt certificates itself:
- Certificates > Let's Encrypt > Register account.
- Certificates > Certificates > Add, action Request Let's Encrypt certificate. Enter the FQDNs and choose the WAN IP they resolve to.
Requirements and limits:
- The names resolve publicly, the same everywhere, to the firewall's WAN IP.
- TCP port 80 reaches the firewall: no DNAT for port 80 on that IP, no upstream or Geo-IP blocks. During validation the firewall adds a temporary WAF rule, briefly interrupting WAF-protected sites.
- HTTP-01 validation only: no wildcards or IP addresses, IPv4 only.
- Certificates last 90 days and renew automatically when fewer than 30 days remain.
- Not usable for remote access VPN or site-to-site VPN. The SSL VPN still needs an uploaded certificate, so it stays on your manual renewal list.
- If the chain shows as incomplete, Sophos KB-000048864 covers Let's Encrypt's newer root and intermediate certificates.
Check your domain
The free scan finds every certificate issued for your domain in the CT logs and flags hosts that still serve an older one after a renewal. See also Certificate renewed but not installed.