Sophos Firewall

Firewall and VPN

Installs a separate certificate and can select it for the admin console, API and associated portals.

What happens

The appliance connects to Sophos Firewall through SFOS XML API on port 4444.
Discovery reports certificate objects, the admin console certificate and its writer. The chain and private key are uploaded in PEM or PKCS#12 as a new object; previous certificates are retained.
SOPHOS_APPLY_TARGET=admin-console selects the certificate in WebAdminSettings Certificate. That setting serves the console, API, user, VPN, captive and SPX portals. Ports and other portal settings are preserved; the package restarts no service. If it fails: If a previously working console stops answering after the switch, the package attempts to restore the previous certificate and checks the recovery result. A console still serving the old certificate is reported as not switched without blind rollback. Rollback uses the deployment backup and changes nothing after an already completed recovery.
Verification finds the new object and compares the admin console’s served SHA-256 fingerprint when the console is selected. Deployment waits up to 120 seconds by default for activation and reads the setting back.

Connection: The package runs on the appliance, which connects over HTTPS to SFOS XML API, port 4444. No agent is installed.
You need: API administrator with certificate and administration-settings permissions. Enable API access under Backup & firmware › API, allow the appliance IP address and HTTPS access from its zone. A refused login is not retried.
Actions: Discovery, Installation, Verification, Rollback, Removal
Packages: sophos-firewall-api
Note: Without SOPHOS_APPLY_TARGET, only the certificate is uploaded; select it on the firewall afterwards. A switch moves only the binding from the previous certificate, including one owned by another writer. Removal deletes only this package’s objects and retains the certificate the console still uses.
Management TLS is verified by default. MANAGEMENT_TLS_PIN_SHA256 accepts exactly the saved certificate before login; MANAGEMENT_TLS_CA_BUNDLE uses a CA file with hostname checks. MANAGEMENT_TLS_INSECURE is an explicit opt-out with a warning; older SOPHOS_TLS settings remain supported. During a console switch the exact new and previous certificates are accepted for readback and recovery; save the new fingerprint before the next run when a pin or private CA requires it.
CERT_NAME allows up to 26 characters for deployment; the new object gets a timestamp. Keep the backup in CERTOPS_BACKUP_DIR or the account’s .sslbrain/sophos-firewall-backups for rollback and the next deployment.