Cisco Secure Firewall (FDM)

Firewall and VPN

Uploads or renews certificate objects and binds them to the Web UI, RA VPN and the other targets discovery found.

What happens

The appliance connects to Cisco Secure Firewall (FDM) through FDM API on port 443.
The certificate object is uploaded or renewed.
The object is bound to the chosen target, and the change is deployed when chosen. If it fails: Rollback puts the target's previous binding back from the backup.
Verification: the package checks target certificate references. For Web UI and RA VPN it also checks activation and the served TLS fingerprint.

Connection: The package runs on the appliance, which connects over HTTPS to FDM API, port 443. No agent is installed.
You need: FDM user allowed to manage certificate objects and deployment.
Platform: Secure Firewall Threat Defense managed with Firewall Device Manager
Actions: Discovery, Installation, Verification, Rollback, Removal
Packages: cisco-fdm-api 0.5.1
Note: Rollback restores bindings, not certificate content overwritten by renewal in the same object. Create a separate object and change the binding to make the whole change reversible.
Discovery finds certificate objects, CA certificates, Web UI, RA VPN, SSL policy and site-to-site VPN references and API capabilities.
Management TLS checks the trust chain and hostname by default. MANAGEMENT_TLS_PIN_SHA256 accepts only the saved SHA-256 fingerprint before login; MANAGEMENT_TLS_CA_BUNDLE uses a CA file and still checks the hostname. MANAGEMENT_TLS_INSECURE disables verification with a warning; FDM_SKIP_TLS_VERIFY remains an explicit alias. Save the new fingerprint before the next run after a Web UI certificate switch.
Existing credentials and PEM input from appliance 0.4.44 remain supported, alongside binary base64 input from 0.4.45. Web UI switches apply without deployment; other targets require completed deployment. Use the active HA unit.