Symptoms

1. A newly imported certificate shows Validated: No in the firewall certificate list.
2. The certificate does not appear in the SSL VPN or management certificate selection drop-downs and therefore cannot be assigned.
3. After the certificate is validated and assigned, Windows clients using Edge/Chrome show an SSL trust warning "NET::ERR_CERT_AUTHORITY_INVALID", while Firefox shows none and validates the chain in its own certificate store.

Cause

• "Validated: No" status. The certificate authority chain (intermediate/root certificate) has not been imported into the firewall — only the signed server certificate was imported. Importing the required certificate chain and then restarting the firewall changes the status to validated, after which the certificate becomes selectable for HTTPS management and SSL VPN. This is a commonly missed step: the core import procedure can be completed correctly while the separate chain-import step is skipped.
  
  Recent observation with GoDaddy/Starfield certificates. In a number of recent cases involving certificates issued by the GoDaddy/Starfield R1 certificate authority, the certificate continues to display a "Validated: No" status even after the intermediate certificate has been imported. This occurs because the firewall does not contain the required root CA certificate needed to complete trust-chain validation. As a result, the firewall cannot establish a complete certificate chain from the signed server certificate to a trusted root certificate, causing validation to fail despite the certificate and intermediate chain being present. 
  
  
• Browser warning on Windows clients. If the firewall shows the certificate as validated and a browser trusts the certificate once the CA's intermediate certificate has been installed locally on the client, the firewall is importing and presenting the certificate correctly. The behaviour then points to trust-chain validation in the Windows certificate store on the client, not to the firewall. Installing the CA's intermediate certificate into the Windows Trusted Root Certification Authorities store on the client removes the warning.
  
  Browser trust-chain validation failure. In these cases, the browser or operating system is unable to verify the certificate authority that issued the server certificate because the required intermediate or root certificate is not present in the local trust store. As a result, the browser cannot build a complete chain of trust from the server certificate to a trusted root certificate and displays a certificate warning even though the firewall is presenting the certificate correctly.
  
  Browser error when it cannot validate the certificate chain:
  
  
  
  

Before you begin

• Export and save a configuration backup of the firewall before making any certificate changes.
• A firewall restart is commonly required after importing a new certificate, so plan a maintenance window. A continuous ping to the firewall can be used to monitor availability during the reboot.
• Keep the previous working certificate in place, or ready to be re-assigned, until the new certificate is validated and tested. If the existing certificate is close to expiry, allow enough time to complete testing before it lapses.

Resolution steps

1. Generate the CSR on the firewall and submit that CSR to your certificate authority.
2. Download the complete certificate package issued by the CA, extract it, and confirm the certificate file format before import.
3. Import the signed server certificate into the firewall.
4. Import the CA / intermediate certificate chain as a separate step. This is the step that clears the "Validated: No" status. If the chain is not included in your package, download the intermediate certificate from your CA's certificate repository, then follow the SonicWall certificate-validation procedure that covers the additional chain-import step for certificates showing Validated: No.
   
   

   Note: If the certificate still shows "Validated: No" after importing the intermediate certificate chain, you are most likely encountering a trust-chain issue where the firewall does not have the required root certificate to validate the chain.

   We are seeing this issue specifically with GoDaddy/Starfield certificates, where the firewall is missing the corresponding built-in root CA certificates.

   To resolve this, open the signed certificate provided by the CA and review the certificate chain. Select the root certificate in the chain and export it in CER format.

   Import the exported root certificate into the firewall by navigating to Device → Certificates, clicking the Import icon, and selecting Import CA Certificate.
   
   Example of one such import (in this case "Starfield TLS Root CA - R1"):
   
   

   
   Once the root certificate has been imported successfully, the certificate validation status should change to Validated: Yes.
   
   

5. Reboot the firewall after both the certificate and the chain have been imported.
6. Confirm the certificate status has changed to validated, confirm it now appears in the SSL VPN and management certificate selection menus, and assign it to the required services.
7. Test client access to the firewall. Use more than one browser and a private/incognito session, and refresh browser sessions before judging the result.
8. If Windows clients still show a warning while Firefox does not, the client trust store is missing the intermediate certificate. As a test, install the CA's intermediate certificate on one Windows client and re-test. If this is required, the certificate has to be installed on every affected system, which is an important consideration for remote users spread across multiple locations.
   
   

   Note: In some cases, importing only the intermediate certificate may not be sufficient. If certificate warnings persist, verify that the root CA certificate is also trusted by the operating system or browser.

   Export the root certificate from the certificate chain and import it into the appropriate trusted certificate store on the client system:

   • Windows: Import the root certificate into the Trusted Root Certification Authorities store.
   • Firefox: If Firefox is using its own certificate store, import the root certificate under Settings → Privacy & Security → Certificates → View Certificates → Authorities.
9. If step 8 is required, contact your certificate authority and ask them to confirm that the complete certificate chain is being provided correctly and whether any additional intermediate certificates are needed for Windows clients to trust the certificate automatically. Make clear that the certificate is installed on a firewall appliance and is used for HTTPS management and SSL VPN server authentication.
10. If the CA supplies an updated certificate or revised instructions and you need assistance importing them onto the firewall, contact SonicWall Technical Support through chat.

Important note on CA-supplied instructions

Certificate authorities sometimes respond with guidance written for general web servers — for example, installing certificate tooling such as Certbot on the server, generating separate client-authentication certificates with a ClientAuth EKU, or configuring mutual TLS (mTLS). Such tooling cannot be installed on a firewall appliance, and those tasks belong to your own server infrastructure or to the CA. Where the firewall has been confirmed to import and present the certificate correctly, no further change is required on the firewall itself. If a CA states that a certificate product is restricted to server authentication and no longer supports client authentication, ask the CA to confirm in writing what that means for your deployment before changing your certificate design.

FAQs

1. Why does my newly imported certificate show "Validated: No"?
The certificate authority chain (intermediate certificate) has not been imported into the firewall. Importing the required chain and restarting the firewall changes the status to validated.

2. Why can't I select the new certificate for HTTPS management or SSL VPN?
A certificate that is not validated does not appear in those certificate selection drop-downs. Once the chain has been imported and the firewall restarted, the certificate appears in both the SSL VPN and management certificate menus.

3. Do I need to reboot the firewall after importing a certificate?
A restart is commonly required after importing a new certificate, and the validated status typically appears after the reboot. Schedule it inside a maintenance window and use a continuous ping to watch for the firewall returning online.

4. Which certificate files should I import?
Import the signed server certificate issued against the CSR you generated on the firewall, and then import the CA/intermediate chain as a separate step. Verify the extracted files and the certificate format before importing.

5. The firewall shows the certificate as validated, but Edge/Chrome still warns while Firefox does not. Is the firewall at fault?
That pattern indicates a Windows client trust-chain issue rather than a firewall issue. Firefox validates the chain in its own certificate store, so it may succeed where Windows-based browsers fail. Installing the intermediate certificate into the Windows Trusted Root Certification Authorities store on the client resolves the warning.

6. Do I have to install a certificate on every client machine?
If Windows clients require the intermediate certificate to be installed manually, it has to be installed on each affected system. This is the main reason to check with your CA whether an updated chain removes the need for manual installation, particularly if you support remote users in multiple locations.

7. What exactly should I ask my certificate authority?
Ask them to confirm that the complete certificate chain is being provided correctly, whether any additional intermediate certificates are required for Windows clients to trust the certificate automatically, and to advise specifically for a certificate used on a firewall appliance for HTTPS management and SSL VPN server authentication.

8. My CA told me to install Certbot and configure client certificates. Can I do that on the firewall?
No. That guidance applies to a general web server environment, not to a firewall appliance. Those steps must be handled on your own server infrastructure or with the CA's assistance.

9. Can I keep running on my previous certificate while this is investigated?
Yes. The previous working certificate can be re-assigned to HTTPS management and SSL VPN so production services continue while testing continues. Watch the remaining validity of that certificate so the new one is deployed before it expires.

10. What should I do before making certificate changes on a production firewall?
Export a configuration backup, plan a maintenance window because a restart may be needed, keep the previous certificate available for rollback, and validate access from client machines using multiple browsers and a private session before treating the change as complete.