SonicOS 8 Device Settings

Technical Documentation>  Managing Certificates>  Configuring Automated Certificate Management Environment
Table of Contents

Configuring Automated Certificate Management Environment

The Automated Certificate Management Environment (ACME) feature in SonicOS automates the provisioning, renewal, and revocation of TLS certificates from public certificate authorities such as Let’s Encrypt. This reduces administrative overhead and helps prevent service disruptions caused by expired certificates.

This feature is supported in SonicOS 8.2.2 and higher versions.

ACME enables SonicOS to:

  • Automatically provision and install TLS certificates
  • Renew certificates before expiration to ensure continuous protection
  • Eliminate the need for manual certificate lifecycle management
  • Allow administrators to manually trigger renewals or revoke certificates at any time through the certificate management interface

This approach ensures secure, uninterrupted service with minimal administrative effort.

Prerequisites

Before using the ACME feature to obtain a certificate from Let's Encrypt, ensure the following conditions are met:

  • WAN internet access: The firewall must have outbound internet connectivity on the WAN interface to reach the Let's Encrypt ACME directory (https://acme-v02.api.letsencrypt.org/directory).
  • Port 80 (HTTP) open on WAN: Inbound port 80 must be allowed on the WAN interface. ACME uses the HTTP-01 challenge method, in which the Let's Encrypt server sends an HTTP request to the firewall on port 80 to verify domain ownership. SonicOS enables this automatically through a default access rule.
  • Valid CSR with a public FQDN: A Certificate Signing Request (CSR) must exist on the firewall with a Common Name (CN) that is a publicly resolvable fully qualified domain name (FQDN) mapping to the WAN IP address of the firewall.
  • Multiple WAN interfaces: If the firewall has multiple WAN interfaces, ensure the correct WAN interface is selected for the ACME challenge-response, matching the interface to which the FQDN resolves.

To configure ACME

  1. Navigate to Device | Settings > Certificates.
  2. On the Certificates page, click Create.

    3. The Create certificates dialog box is displayed.

  3. Select the Automatically Provision Certificate (ACME) option and click Next.

  4. On the ACME Configuration page, enter the following information.

    1. From the CSR List drop-down menu, select the Certificate Signing Request.

      To create a new certificate signing request, select Create new CSR. For more information, refer to Generating a Certificate Signing Request.

    2. The Common Name field displays the common name of the selected certificate signing request.

      3. If the CSR does not include a valid common name, a warning is displayed and the Confirm button remains disabled.

  5. Click Confirm.

    6. The certificate is listed as an ACME certificate.

Chat