# Replace an expiring certificate on Sophos Firewall (VPN, portals and WAF)

Sophos Firewall keeps serving the old certificate until you upload the renewed
one and select it in each place that uses it. This runbook covers SFOS 21 and
22; the menu paths are the same in both.

## 1. Upload the certificate and its chain

1. **Certificates > Certificates > Add.** Action: **Upload certificate**.
2. Enter a name and choose the format: **PKCS #12** (`.pfx`/`.p12`, key
   included) or **PEM** (certificate and private key as separate files).
3. Select the files, enter the passphrase (30 characters at most) and Save.
4. Upload the **intermediate** certificate under **Certificates > Certificate
   authorities > Add**, and the root if your CA requires it. For a root CA,
   set **Use certificate for** to **Validation only**.

In the certificate list, the **Trusted** column should show a green check.

Keep the firewall clock correct (NTP). A wrong time can make imports fail.

## 2. Assign it

**Admin console and portals:** **Administration > Admin and user settings**,
section **Admin console and end-user interaction**, field **Certificate**.
This one setting covers the web admin console, the user portal, the VPN portal
and the captive portal. Click Apply.

**SSL VPN (remote access):** **Remote access VPN > SSL VPN > SSL VPN global
settings > SSL server certificate.** If an intermediate CA issued the
certificate, make sure the intermediate and root are uploaded too.

**Web server protection (WAF):** **Rules and policies > Firewall rules**, open
each rule whose action is **Protect with web server protection**, and select
the new certificate in its HTTPS settings. Two things to know:

- The certificate's names replace the rule's **Domains** list, so check it
  after saving.
- Saving restarts the WAF rules and drops current connections.

## 3. Tell VPN users

- **Sophos Connect users** click **Update policy** in the client, or reimport
  the provisioning file.
- **Users with a manually imported `.ovpn` file** download and import a fresh
  copy from the VPN portal.
- **Site-to-site SSL VPN:** download the server configuration again and upload
  it to the client firewall.

## 4. Check it from outside

```
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null
```

Check the expiry date and that the intermediate is sent. Repeat for the WAF
hostnames and the SSL VPN port if it differs.

## Common problems

- **The old certificate can't be deleted:** something still uses it. Change
  every assignment above first.
- **Untrusted or incomplete chain:** upload the intermediate (and root) under
  Certificate authorities.
- **WAF hostnames stopped matching:** the Domains list was replaced by the
  certificate's names. Correct it in the rule.

## Let the firewall renew it: Let's Encrypt

Since **SFOS 21.0** the firewall can request and renew Let's Encrypt
certificates itself:

1. **Certificates > Let's Encrypt > Register account.**
2. **Certificates > Certificates > Add**, action **Request Let's Encrypt
   certificate**. Enter the FQDNs and choose the WAN IP they resolve to.

Requirements and limits:

- The names resolve publicly, the same everywhere, to the firewall's WAN IP.
- TCP port 80 reaches the firewall: no DNAT for port 80 on that IP, no
  upstream or Geo-IP blocks. During validation the firewall adds a temporary
  WAF rule, briefly interrupting WAF-protected sites.
- HTTP-01 validation only: no wildcards or IP addresses, IPv4 only.
- Certificates last 90 days and renew automatically when fewer than 30 days
  remain.
- **Not usable for remote access VPN or site-to-site VPN.** The SSL VPN still
  needs an uploaded certificate, so it stays on your manual renewal list.
- If the chain shows as incomplete, Sophos KB-000048864 covers Let's Encrypt's
  newer root and intermediate certificates.

## Check your domain

The free scan finds every certificate issued for your domain in the CT logs
and flags hosts that still serve an older one after a renewal. See also
[Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## Sources

- [Sophos: add a certificate (SFOS 22.0)](https://docs.sophos.com/nsg/sophos-firewall/22.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/Certificates/CertificateAdd/index.html)
- [Sophos: add external root and intermediate CAs](https://docs.sophos.com/nsg/Sophos-firewall/23.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/HowToArticles/CertificatesAddExternalRootIntermediateCAs/index.html)
- [Sophos: admin and user settings](https://docs.sophos.com/nsg/sophos-firewall/23.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Administration/AdminSettings/index.html)
- [Sophos: remote access VPN FAQ](https://docs.sophos.com/nsg/sophos-firewall/21.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/RAVPNFAQ/index.html)
- [Sophos: add a firewall rule (web server protection)](https://docs.sophos.com/nsg/sophos-firewall/22.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/FirewallRuleAdd/index.html)
- [Sophos: Let's Encrypt certificates (SFOS 22.0)](https://docs.sophos.com/nsg/sophos-firewall/22.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/LetsEncrypt/index.html)

---
Source: https://nameward.app/guides/sophos-firewall-replace-certificate (updated 2026-10-29)