Automated Certificate Management Environment (ACME) on SonicOS 8.2.2-8015

You can use the Automated Certificate Management Environment (ACME) protocol to create trusted TLS certificates for public domains from a certificate authority such as Let's Encrypt™. SonicOS uses an automated process to request, validate, install, and renew these certificates. It issues X.509 certificates. 

Create ACME certificates

To create an ACME certificate, you must first generate a certificate signing request (CSR) with a publicly resolvable common name. You then request an ACME certificate against that CSR. After the certificate authority validates the request, the certificate is installed automatically and is available for use with SonicOS features.

The certificate authority must communicate with the firewall to validate the request. SonicOS uses the HTTP-01 challenge method: the certificate authority sends an inbound HTTP request to the firewall on port 80 to confirm that you control the domain. SonicOS permits this traffic automatically through a default access rule if the HTTP management is enabled on the WAN interface.

Requirements

• The firewall must have outbound internet access on the WAN interface to reach the Let's Encrypt ACME directory at https://acme-v02.api.letsencrypt.org/directory.
• Inbound HTTP port 80 must not be blocked by an access rule or an upstream device, including Geo-IP filtering rules. SonicOS 8.2.2 enables Geo-IP Filtering by default on new GEN8 registrations, so confirm that your Geo-IP policy does not drop the validation request. The Let's Encrypt validation servers are located in multiple countries.
• A CSR must exist on the firewall with a common name (CN) that is a publicly resolvable fully qualified domain name (FQDN).
• The DNS record for the FQDN must be public and must resolve to the firewall's WAN IP address. Use a public DNS checker such as DNS Checker to verify the domain.
• The DNS record must resolve to the same IP address for all DNS providers and regions. Avoid resolutions that vary by location.
• Only a single IP address should be present in the DNS record.
• Make sure no NAT policy applies to the public IP address of the firewall's WAN interface on port 80, so that the validation request is not forwarded to another device.
• If the firewall has multiple WAN interfaces, make sure the FQDN resolves to the WAN interface that answers the ACME challenge.

Restrictions

• SonicOS supports the HTTP-01 challenge method only. The DNS-01 challenge method is under evaluation for a future release. Deployments that cannot expose inbound port 80 on the WAN cannot use this feature.
• You cannot request wildcard certificates. Wildcard issuance requires the DNS-01 challenge method.
• You cannot use an internal-only name, a split-horizon DNS name, or an IP address as the common name.
• ACME is supported in SonicOS 8.2.2 and higher. It is not available on earlier SonicOS 8 releases, and it is not available on GEN7 appliances. Let's Encrypt integration is planned for GEN7 in SonicOS 7.3.4.

Generate a certificate signing request

1. Go to Device > Settings > Certificates.
2. Click Create. The Create certificates dialog box is displayed.
3. Select New Signing Request and click Next.
4. Set Common Name to the publicly resolvable FQDN of the firewall, for example firewall.example.com.
5. Complete the subject fields as required by your organization and Click on Generate.
   
   

Add an ACME certificate

1. Go to Device > Settings > Certificates.
2. Click Create. The Create certificates dialog box is displayed.
3. Select Automatically Provision Certificate (ACME) and click Next.
4. On the ACME Configuration page, select the certificate signing request from the CSR List drop-down menu.

To create a new request instead, select Create new CSR.

5. Set Common Name to the publicly resolvable FQDN of the firewall, for example firewall.example.com.
6. Complete the subject fields as required by your organization, and Click on Generate.
7. Click Confirm.

The certificate is listed as an ACME certificate on the Certificates page.

Note:

If the selected request does not contain a valid common name, SonicOS displays a warning and **Confirm** remains disabled. Correct the request before continuing. Do not submit repeatedly, because failed validation attempts consume the certificate authority's rate limit allowance.

Automatic certificate renewal

SonicOS renews ACME certificates automatically before they expire. No reboot, service restart, or administrator action is required, and services using the certificate are not interrupted.

Renewal repeats the same HTTP-01 validation used at initial issuance, so the requirements listed above must remain satisfied for the life of the certificate. Renewal fails if inbound port 80 is later blocked, if the DNS record is changed, or if the WAN IP address changes without a corresponding DNS update.

Certificate validity periods are set by the certificate authority, not by SonicOS. Let's Encrypt has progressively shortened certificate lifetimes, so automated renewal is the recommended operating model.

Renew or revoke an ACME certificate manually

You can force a renewal or revoke an ACME certificate at any time.

1. Go to Device > Settings > Certificates.
2. Hover over the ACME certificate.
3. Do one of the following:
• To renew the certificate, click the Renew icon.
• To revoke the certificate, click the Revoke icon.

Force a renewal when a previous automatic renewal failed and you have corrected the cause, or when your organization requires re-keying.
Revoke a certificate when the private key may be compromised, when the appliance is being decommissioned, or when the FQDN is being retired.

Warning:

Revoking a certificate does not reset the certificate authority's rate limits. The issuance capacity used to create that certificate is not returned. Do not revoke and re-issue repeatedly as a troubleshooting method.

Note:

Let's Encrypt allows a limited number of certificates for the same set of domain names within a rolling period, and a limited number of failed validation attempts per hour. Verify DNS resolution and inbound port 80 reachability from an external host before requesting a certificate, rather than using repeated requests as a diagnostic method. For current limits, see rate limits at https://letsencrypt.org/docs/rate-limits/

Related information

• SonicOS 8 Device Settings Administration Guide — Managing Certificates
• SonicOS 8 Device Settings Administration Guide — Generating a Certificate Signing Request
• SonicOS 8.2.2 Release Notes
• Let's Encrypt rate limits
• Let's Encrypt staging environment
• Let's Encrypt Policy and Legal Repository

Let's Encrypt is a trademark of the Internet Security Research Group. All rights reserved.