Manage Certificates on the Management Server

To view and complete all the management tasks for the certificates on your Management Server, you can use the WatchGuard WebCenter tool, CA Manager. To only view or delete certificates on the Management Server, you can also use the Certificate Maintenance tool in WatchGuard System Manager.

Connect to CA Manager

You can either launch CA Manager from WatchGuard System Manager, or connect to CA Manager directly in your web browser.

To connect to CA Manager from WSM:

1. Open WatchGuard System Manager and connect to your Management Server.
   You must type the configuration passphrase to connect.
2. Select the Device Management tab.
3. Click .
   Or, select Tools > CA Manager.

To connect to CA Manager from a web browser:

1. Open a web browser and go to https://<IP address of your Management Server>:4130.
   The WatchGuard WebCenter  login page appears.
2. Type your user credentials and click Login.
   WatchGuard WebCenter appears.
3. In the left navigation menu, select an option from the CA MANAGER section.
   

After you have connected to CA Manager, you can view, generate, revoke, reinstate, destroy, upload, and publish certificates for your Management Server and managed devices.

Manage Current Certificates

From CA Manager, you can search for the certificates on you Management Server by serial number, common name, or organizational unit. You can revoke, reinstate, or destroy any certificate in the list. When you revoke a certificate, it is added to the Certificate Revocation List (CRL) and cannot be used for authentication. When you reinstate a certificate, it is removed from the CRL and can be used again. When you remove or destroy a certificate, it is not added to the CRL, but it cannot be used for authentication. The CRL is published to each Firebox when the Firebox connects to the Management Server.

To manage the current certificates for your Fireboxes and Management Server:

1. Select CA MANAGER > Manage.
   The Manage page appears, with a list of all the devices for which the Management Server has stored certificates.

2. Follow the instructions in the next sections to manage your certificates.

Filter the Certificates List

You can filter the list of certificates that appears on the Manage page to find a specific certificate in the list.

 To filter the list of certificates:

1. From the left filter drop-down list, select an option to filter on:
   • Serial Number
   • Common Name
   • Org Unit
2. In the filter text box, type the text that corresponds to the filter option you selected.
   For example, if you selected Serial Number, type the serial number that appears in the Serial column for the certificate you want to find.
3. From the Filter drop-down list, select an option:
   • All
   • Valid Only
   • Revoked Only
   • Expired Only
4. Click Search.
   The certificates list is updated to only include certificates that match the parameters you specified.

Change the Certificate Status

The certificate list includes the status of each certificate managed by your Management Server CA. From the Manage page, you can revoke, reinstate, or destroy any certificate in the list. For example, if you have several certificates that were revoked that you want to reinstate, you can select each of those certificates and change the status for all of the selected certificates at the same time.

To change the status of one or more certificates from the certificate list:

1. Select the check box adjacent to each certificate.
2. From the Action drop-down list, select an action:
   • Revoke
   • Reinstate
   • Destroy

When you are finished, the new certificate status appears in the Status column.

You can also change the status of the certificate when you view the full certificate data.

From the certificate list:

1. Double-click the number in the Serial column for the certificate.
   The View Certificate Data dialog box appears.
2. Click the button for the action to complete:
   • Revoke
   • Reinstate
   • Destroy

View Certificates

From CA Manager, you can review the certificate details for the Certificate Authority and Management Server CA certificates. For the other certificates managed by your Management Server, you can also see the full certificate details, which includes the signature algorithm, issuer, and public key information.

To see the Certificate Authority (root) certificate and the Management Server CA certificates:

1. From the CA MANAGER section, select View.
   The View page appears with the text of the CA Certificate and Management Server CA Certificate.

2. To save the contents of either certificate, select the certificate text and copy it to a file on your computer.

To view the full data of a certificate:

1. From the CA MANAGER section, select Manage.
   The Manage page appears.
2. In the Serial column for the certificate, double-click the serial number.
   The View Certificate Data dialog box appears.

Create a New Certificate Request

To create a new certificate signing request (CSR):

1. From the CA MANAGER section, select Generate.
   The Generate a New Certificate page appears.

2. Type the common name, password, and certificate lifetime for the subject.
   • For Firebox Authentication users, the common name must agree with the identification information for the XTM device (usually, the device IP address).
   • For a generic certificate, the common name is the name of the user.
3. To download the certificate after it is generated, select the Download Cert check box.
4. Click Generate.

For more information about how to create certificates, see Create a Certificate with FSM or the Management Server.

Sign a Certificate Request

You can also use CA manager to sign a certificate request from a different device. Make sure you have the common name and the organizational unit for the certificate before you proceed.

To sign a certificate request:

1. From the CA Manager section, select Upload.
   The Upload page appears.

2. Type the Common Name and the Organizational Unit for the certificate.
3. Click Browse to find the CSR (Certificate Signing Request) file.
4. Click Upload.

Publish the Certificate Revocation List

From CA Manager, you can make the CRL (Certificate Revocation List) available to each Firebox that is connected to your Management Server.

1. From the CA Manager section, select Publish.
   The Publish page appears.
2. Click Publish.

When a managed Firebox next attempts to validate the certificate, the certificate is disabled. If a revoked certificate was used for VPN authentication, the VPN tunnel is disabled.

Manage Certificates From WatchGuard System Manager

To see certificates used by the Management Server and delete those that are no longer needed:

1. Open WatchGuard System Manager and connect to the Management Server.
   You must type the configuration passphrase to connect.
2. Select File > Certificates.
   The Certificate Maintenance dialog box appears with a list of the certificates used by the Management Server.

3. To delete a certificate, select it and click Remove.
   If the certificate is currently used by the Management Server, you must first disconnect from the server before you delete the certificate.
4. Click OK.

When you delete a Management Server certificate, you do not delete certificates in Microsoft Internet Explorer.

See Also

About Certificates

Manage Device Certificates (WSM)

See Log Messages & Reports in WebCenter

Connect to WatchGuard WebCenter

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.