letsencrypt

subscribe via RSS

Manual cert-bot renewals for certificates hosted on a Sophos UTM

30 Aug 2017

Renew your cert-bot certificate

I have a cert-bot certificate on my home licensed Sophos UTM. Yeah, yeah. I should upgrade to the Home XG. One of these days … maybe. I also use the Remote Access feature (SSL VPN) to gain access to my stuff at home when I’m out and about. I don’t have to leave my SSH, or other, ports wide open. It’s just good practise. But, because it needs the user portal to get your certificates and configs for the OpenVPN SSL VPN, I can’t use cert-bot’s automatic renewal, as the required URL’s aren’t normally available. The reverse proxy configuration (Web Server Protection) doesn’t seem to work with the User Portal also enabled. So, I have to go manual.

The basic steps for me go like this:

  • Start the cert-bot manual process
  • Disable the Sophos User Portal
  • Start up a Web Server Protection config to send my requests to a backend server. This could the cert-bot temp web server. But not in my case. Because “reasons”.
  • Put the codes into the files (or it gets the hose) as cert-bot expects to browse them.
  • Verify it all works
  • Complete the cert-bot renewal
  • Disable the Web Server Protection
  • Re-enable the User Portal
  • Convert the certificates into a PKCS#12 cert
  • Upload to Sophos Certificate Manager
  • Change your Sophos config to use the new PKCS#12 cert
  • Good to go
cert-bot letsencrypt sophos utm