Symptoms

1. A newly imported certificate shows Validated: No in the firewall certificate list.
2. The certificate does not appear in the SSL VPN or management certificate selection drop-downs and therefore cannot be assigned.
3. After the certificate is validated and assigned, Windows clients using Edge/Chrome show an SSL trust warning "NET::ERR_CERT_AUTHORITY_INVALID", while Firefox shows none and validates the chain in its own certificate store.

Cause

"Validated: No" status. The certificate authority chain (intermediate/root certificate) has not been imported into the firewall — only the signed server certificate was imported. Importing the required certificate chain and then restarting the firewall changes the status to validated, after which the certificate becomes selectable for HTTPS management and SSL VPN. This is a commonly missed step: the core import procedure can be completed correctly while the separate chain-import step is skipped.

Browser warning on Windows clients. If the firewall shows the certificate as validated and a browser trusts the certificate once the CA's intermediate certificate has been installed locally on the client, the firewall is importing and presenting the certificate correctly. The behaviour then points to trust-chain validation in the Windows certificate store on the client, not to the firewall. Installing the CA's intermediate certificate into the Windows Trusted Root Certification Authorities store on the client removes the warning.

Before you begin

• Export and save a configuration backup of the firewall before making any certificate changes.
• A firewall restart is commonly required after importing a new certificate, so plan a maintenance window. A continuous ping to the firewall can be used to monitor availability during the reboot.
• Keep the previous working certificate in place, or ready to be re-assigned, until the new certificate is validated and tested. If the existing certificate is close to expiry, allow enough time to complete testing before it lapses.

Resolution steps

1. Generate the CSR on the firewall and submit that CSR to your certificate authority.
2. Download the complete certificate package issued by the CA, extract it, and confirm the certificate file format before import.
3. Import the signed server certificate into the firewall.
4. Import the CA / intermediate certificate chain as a separate step. This is the step that clears the "Validated: No" status. If the chain is not included in your package, download the intermediate certificate from your CA's certificate repository, then follow the SonicWall certificate-validation procedure that covers the additional chain-import step for certificates showing Validated: No.
5. Reboot the firewall after both the certificate and the chain have been imported.
6. Confirm the certificate status has changed to validated, confirm it now appears in the SSL VPN and management certificate selection menus, and assign it to the required services.
7. Test client access to the firewall. Use more than one browser and a private/incognito session, and refresh browser sessions before judging the result.
8. If Windows clients still show a warning while Firefox does not, the client trust store is missing the intermediate certificate. As a test, install the CA's intermediate certificate on one Windows client and re-test. If this is required, the certificate has to be installed on every affected system, which is an important consideration for remote users spread across multiple locations.
9. If step 8 is required, contact your certificate authority and ask them to confirm that the complete certificate chain is being provided correctly and whether any additional intermediate certificates are needed for Windows clients to trust the certificate automatically. Make clear that the certificate is installed on a firewall appliance and is used for HTTPS management and SSL VPN server authentication.
10. If the CA supplies an updated certificate or revised instructions and you need assistance importing them onto the firewall, contact SonicWall Technical Support.

Important note on CA-supplied instructions

Certificate authorities sometimes respond with guidance written for general web servers — for example, installing certificate tooling such as Certbot on the server, generating separate client-authentication certificates with a ClientAuth EKU, or configuring mutual TLS (mTLS). Such tooling cannot be installed on a firewall appliance, and those tasks belong to your own server infrastructure or to the CA. Where the firewall has been confirmed to import and present the certificate correctly, no further change is required on the firewall itself. If a CA states that a certificate product is restricted to server authentication and no longer supports client authentication, ask the CA to confirm in writing what that means for your deployment before changing your certificate design.

FAQs

1. Why does my newly imported certificate show "Validated: No"?
The certificate authority chain (intermediate certificate) has not been imported into the firewall. Importing the required chain and restarting the firewall changes the status to validated.

2. Why can't I select the new certificate for HTTPS management or SSL VPN?
A certificate that is not validated does not appear in those certificate selection drop-downs. Once the chain has been imported and the firewall restarted, the certificate appears in both the SSL VPN and management certificate menus.

3. Do I need to reboot the firewall after importing a certificate?
A restart is commonly required after importing a new certificate, and the validated status typically appears after the reboot. Schedule it inside a maintenance window and use a continuous ping to watch for the firewall returning online.

4. Which certificate files should I import?
Import the signed server certificate issued against the CSR you generated on the firewall, and then import the CA/intermediate chain as a separate step. Verify the extracted files and the certificate format before importing.

5. The firewall shows the certificate as validated, but Edge/Chrome still warns while Firefox does not. Is the firewall at fault?
That pattern indicates a Windows client trust-chain issue rather than a firewall issue. Firefox validates the chain in its own certificate store, so it may succeed where Windows-based browsers fail. Installing the intermediate certificate into the Windows Trusted Root Certification Authorities store on the client resolves the warning.

6. Do I have to install a certificate on every client machine?
If Windows clients require the intermediate certificate to be installed manually, it has to be installed on each affected system. This is the main reason to check with your CA whether an updated chain removes the need for manual installation, particularly if you support remote users in multiple locations.

7. What exactly should I ask my certificate authority?
Ask them to confirm that the complete certificate chain is being provided correctly, whether any additional intermediate certificates are required for Windows clients to trust the certificate automatically, and to advise specifically for a certificate used on a firewall appliance for HTTPS management and SSL VPN server authentication.

8. My CA told me to install Certbot and configure client certificates. Can I do that on the firewall?
No. That guidance applies to a general web server environment, not to a firewall appliance. Those steps must be handled on your own server infrastructure or with the CA's assistance.

9. Can I keep running on my previous certificate while this is investigated?
Yes. The previous working certificate can be re-assigned to HTTPS management and SSL VPN so production services continue while testing continues. Watch the remaining validity of that certificate so the new one is deployed before it expires.

10. What should I do before making certificate changes on a production firewall?
Export a configuration backup, plan a maintenance window because a restart may be needed, keep the previous certificate available for rollback, and validate access from client machines using multiple browsers and a private session before treating the change as complete.