Automated SSL certificate renewal for Cisco Firepower

Firepower won't update a renewed certificate on its own. CertKit will.

A Firepower (FTD) device stores certificates as objects, and the Remote Access VPN's identity certificate and a SAML server's service provider certificate each reference one. Whether you manage the device on the box with Firepower Device Manager or centrally with Firepower Management Center, those references keep pointing at the old certificate until someone uploads the new one, re-selects it, and runs a deployment. Every 47 days. On every firewall you manage.

CertKit centralizes certificate issuance and renewal, then pushes the renewed certificate to your Firepower devices automatically via the CertKit Agent and the FDM or FMC REST API, applies it to the service you choose, and runs the deployment for you.

Start free trial Watch demo

Built for Cisco Firepower

Pre-built templates for the Remote Access VPN and SAML server, on FDM or FMC, ship in your CertKit account. No scripting required. FMC support is currently in beta.

CertKit renews your Firepower certificate for you. On every renewal it uploads the new certificate and its CA chain over the FDM or FMC REST API, applies it to the Remote Access VPN or SAML server you picked, removes the old certificate, and runs the deployment (on FMC, the cleanup comes after it). On FMC it also installs the certificate on every device the VPN policy is assigned to, so one template covers every firewall that serves the VPN. No console clicks, no manual upload, no forgotten Deploy button.

Schedule CertKit's deployments in a maintenance window so a half-finished change from earlier in the day doesn't go live at renewal time.

How to install an SSL certificate on Cisco Firepower

The manual process, if you want to do it yourself:

Generate a private key and certificate request. Create the key and CSR with OpenSSL. Firepower Device Manager expects you to bring the certificate and key with you, and FMC takes them most easily as a PKCS12 (.pfx) file that bundles the certificate, key, and chain.
Submit the CSR to a certificate authority. Purchase a certificate or use a free ACME CA, then wait for the signed certificate file to come back. A wildcard certificate covers the VPN headend and everything else on the domain.
Import the certificate. In FDM, under Objects → Certificates, add an Internal Certificate and paste the PEM certificate and private key. Upload each intermediate CA in the chain separately as a Trusted CA certificate. In FMC, go to Devices → Certificates, click Add, pick the device, and create a certificate enrollment with the PKCS12 File enrollment type. Repeat for every device. Re-enroll doesn't renew a PKCS12 certificate, and a red X next to the CA means the file is missing its chain.
Re-select the certificate on every service that uses it. The Remote Access VPN certificate that AnyConnect and Secure Client users see lives under Device → Remote Access VPN in FDM. In FMC, edit the policy under Devices → VPN → Remote Access and pick the SSL Global Identity Certificate on the Access Interfaces tab. Each SAML server object also has a service provider certificate. Neither refreshes on its own.
Deploy the pending changes. Click Deploy in FDM, or select the devices under Deploy → Deployment in FMC, and wait for the job to finish. Until you do, the device keeps serving the old certificate. When you do, every other pending change on the device deploys with it.

Every one of these steps is manual, and Firepower won't repeat any of them for you when the certificate renews. With lifetimes shrinking to 47 days, installation stops being an annual chore and becomes a recurring task: twelve times a year, on every firewall you manage. Miss one and remote workers get a certificate warning from Secure Client, or stop connecting entirely.

At 47 days, automation is the only sustainable way to run Firepower certificates. Here's how CertKit does it.

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │CertKit Agent├──┼────►│  Issue & Renew   │◄──►│             │
│  └──┬────┬─────┘  │     │   Certificates   │    │             │
│     │    │FDM/FMC │     │                ┌───┐  └─────────────┘
│     │    │ REST   │     └───────────┬────│DNS│
│     ▼    ▼        │                 │    └───┘
│ ┌──────────────┐  │                 │
│ │ Firepower    │  │                 │
│ │ [x] Uploaded │  │ ◄───────────────┘
│ │ [x] Deployed │  │       Verify
│ └──────────────┘  │
└───────────────────┘

CertKit issues and renews certificates centrally in the cloud using delegated DNS validation. You create a one-time CNAME record; CertKit handles every ACME challenge after that.

The CertKit Agent is a small service you run on a server inside your network. It makes an outbound HTTPS connection to CertKit to pull each renewed certificate, then connects on your LAN to the device's FDM REST API, or to the FMC REST API for managed devices, to upload the certificate, apply it, and run the deployment. The firewall never talks to CertKit or the public internet directly, never runs ACME, needs no port 80 open, and never stores DNS credentials. One CertKit Agent can reach every Firepower and other appliance on that network, so there's nothing to install on the firewalls themselves.

CertKit has transformed how Belden manages SSL certificate issuance, delivering a streamlined process that dramatically reduced both cost and complexity. Their solution has been a clear win for our organization.

Ryan Buckner, IT Infrastructure Analyst, Belden

Two places Firepower uses your certificate

An FTD device presents your certificate in two different roles, each configured through a different part of the FDM or FMC API. CertKit ships a pre-built template for each role on each manager. Pick the ones you use, and the rest stay untouched.

Remote Access VPN Identity certificate for AnyConnect and Secure Client SAML server Service provider certificate in the SAML exchange

What CertKit handles

Issue certificates via ACME, centrally. Your firewalls have no ACME configuration, no open ports, no public DNS credentials. One CNAME record is all your domain contributes.
Renew automatically before expiry. That one-time CNAME covers every renewal challenge going forward. No intervention required on any device.
Upload the certificate and chain over the FDM or FMC REST API. On FDM, the CertKit Agent uploads the renewed certificate and key as an internal certificate object and registers each intermediate CA in the chain as a trusted CA certificate, skipping any the device already holds. On FMC 7.7 or later, it uploads the certificate, key, and chain as one PKCS12 certificate enrollment and installs it on every device that serves the VPN or SAML server.
Apply it to the service you choose. The template finds the Remote Access VPN that owns the connection profile you name and sets its certificate, or updates the service provider certificate on the SAML server you name. On FMC, the VPN template also updates the IPsec-IKEv2 identity certificate and any interface certificate that used the old one. Each is a separate template, so you deploy only what a given firewall uses.
Use deterministic, prefixed names. CertKit names each certificate certkit- plus an ID and thumbprint, so the same renewal is never uploaded twice and its certificates are easy to spot in FDM or FMC.
Clean up old certificates. After the new certificate is applied, CertKit deletes the superseded certkit- certificates. If one is still referenced elsewhere, it's left in place rather than forced, so a delete never breaks an unrelated binding.
Run the deployment and wait for it. Uploading a certificate changes nothing until it's deployed. The agent starts the FDM or FMC deployment job and polls it to completion, failing loudly if the job doesn't reach the deployed state.
Work with self-signed management certificates. The agent reaches the FDM or FMC API over HTTPS and tolerates the default self-signed management certificate that most devices ship with.
Verify the deployment, not just the script. After each renewal, CertKit connects to your VPN headend and confirms the new certificate is actually being served. It checks the serial number, SANs, and expiry. If something is wrong, you find out before your users do.
Alert on failure. Upload failures, deployment errors, verification mismatches, and upcoming expirations all generate alerts before they become incidents.
Audit every change. Every issuance, renewal, and deployment is logged with timestamp, certificate, and device. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit. Every renewal challenge after that is automatic.
Create an account for CertKit. On FDM, the agent needs an administrator allowed to manage certificate objects, the Remote Access VPN or SAML servers, and deployments. On FMC 7.7 or later, it needs a dedicated API account with permission for certificate enrollments, device certificates, the VPN policy or SAML server, and deployments. FMC ends a web session that shares the API account's credentials, so don't reuse anyone's login.
Install the CertKit Agent. One command on any Windows host with HTTPS reachability to the FDM or FMC management address. The agent runs as a background service and needs no inbound firewall rules.
Add the Firepower deployment script. Choose the FDM or FMC template for the RA VPN or SAML server, then set the management address, the credentials, and the connection profile or SAML server name. CertKit runs it on every renewal.

See the full architecture →

Cisco Firepower deployment requirements and troubleshooting →

Why not run ACME on the firewall?

FTD has no ACME client, and giving a perimeter security device what ACME needs is a bad trade anyway: DNS provider credentials on the firewall are a privilege escalation waiting to happen, and opening port 80 to the public on the device that terminates your VPN is worse.

Scripting the FDM or FMC API yourself has its own sharp edges: token authentication, separate object types for internal certificates and trusted CAs on FDM, per-device enrollment on FMC, walking the RA VPN configuration to find the one that owns your connection profile, and a deployment job you have to start and babysit or nothing actually changes. We built and tested the deployment so you don't have to. CertKit issues the certificate via delegated DNS validation, then the agent handles the upload, the binding, the cleanup, and the deployment as one verified step, with no ACME client on the firewall.

Firepower is just one part of your network edge

Most networks have more than one place where TLS certificates live: load balancers like F5 BIG-IP and Citrix NetScaler, VPN gateways like Ivanti Connect Secure, web servers, and other firewall vendors like Fortinet, Palo Alto, SonicWall, and Juniper SRX, plus the Aruba ClearPass or Cisco ISE cluster handling network access control. CertKit automates all of it from one account.

See all integrations

Start automating Firepower certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing