Sophos XG API/CLI: Certificate in WAF rule cannot be changed due to error

Please post the full request

I should have asked a couple more questions before also...

1. How are you sending/receiving data to the API?  Are you using curl?
2. Are you saving the XML to a file and then sending or are you sending it "inline"
If sending "inline" are you properly escaping the quotes?

I should have asked a couple more questions before also...

1. How are you sending/receiving data to the API?  Are you using curl?
2. Are you saving the XML to a file and then sending or are you sending it "inline"
If sending "inline" are you properly escaping the quotes?

I am using powershell. Contrusting MultipartFormDataContent object. With single form-data field reqxml. 

Following code is used to retrieve the Securitypolicy

```

Add-Type -AssemblyName System.Net.Http

$httpClientHandler = New-Object System.Net.Http.HttpClientHandler
$httpClient = New-Object System.Net.Http.Httpclient $httpClientHandler

$xml = [xml]@"
<Request>
<Login>
<Username>admin</Username>
<Password passwordform=`"plain`">SecretPassword</Password>
</Login>
<Get>
<SecurityPolicy>
<Filter>
<key name="Name" criteria="=">RDG 2019</key>
</Filter>
</SecurityPolicy>
</Get>
</Request>
"@

$multipartContent = [System.Net.Http.MultipartFormDataContent]::new()

$stringHeader = [System.Net.Http.Headers.ContentDispositionHeaderValue]::new("form-data")
$stringHeader.Name = "reqxml"
$StringContent = [System.Net.Http.StringContent]::new($xml.OuterXml)
$StringContent.Headers.ContentDisposition = $stringHeader
$StringContent.Headers.ContentType = 'application/xml'
$StringContent.Headers.ContentType.CharSet = 'utf-8'
$multipartContent.Add($stringContent)

$uri = 'https://xg-01:4444/webconsole/APIController'

$response = $httpClient.PostAsync($Uri, $multipartContent).Result

$result = [xml]$response.Content.ReadAsStringAsync().Result
$result.Response

```

which results in the following post : 

Method: POST, RequestUri: 'xg-01:4444/.../APIController', Version: 1.1, Content: System.Net.Http.MultipartFormDataContent, Headers:
{
Content-Type: multipart/form-data; boundary="358a0f19-2b25-4a7b-9ec7-49d6b08eb4ee"
Content-Length: 393
}
--358a0f19-2b25-4a7b-9ec7-49d6b08eb4ee
Content-Type: application/xml; charset=utf-8
Content-Disposition: form-data; name=reqxml

<Request><Login><Username>admin</Username><Password passwordform="plain">SecretPassword</Password></Login><Get><SecurityPolicy><Filter><key name="Name" criteria="=">RDG 2019</key></Filter></SecurityPolicy></Get></Request>
--358a0f19-2b25-4a7b-9ec7-49d6b08eb4ee--

I could place something in between to get the raw request. This is what worked uploading a certificate by adding the file to the MultipartFormDataContent object. So I was assuming the post is correct. 

Thank you for the quick responses. 

This is what I uploaded via Curl and it just changed the name of the certificate on the system I am working on:

PLEASE NOTE:  the parts in ( ) are there for others that are still learning how to do this...  They cannot be in the actual XML file
Yellow highlights should be replaced with your own data

<Request APIVersion="1702.1">
        <Login>
            <Username>apiuser</Username> 
            <Password>your password</Password>
        </Login>
        <Set operation="update">
                <SecurityPolicy>
                        <Name>policy name</Name>                                               (Name from Protect->Firewall)
                        <PolicyType>HTTPBased</PolicyType>
                        <HTTPBasedPolicy>
                                <HostedAddress>#Port2</HostedAddress>
                                <HTTPS>Enable</HTTPS>
                                <ListenPort>443</ListenPort>
                                <AccessPaths>
                                        <AccessPath>
                                                <allowed_networks>Any IPv4</allowed_networks>
                                                <auth_profile/>
                                                <backend>websever name</backend>           (Name from Protect->Web server->Web servers)
                                                <be_path/>
                                                <hot_standby>0</hot_standby>
                                                <path>/</path>
                                        </AccessPath>
                                </AccessPaths>
                                <Domains>
                                        <Domain>www.example.com</Domain>.               (DNS Domain Name)
                                </Domains>
                                <Certificate>name of certificate you provided when you uploaded the certificate to the XG</Certificate> (Certificate name from System->Certificates)
                        </HTTPBasedPolicy>
                </SecurityPolicy>
        </Set>
</Request>

The above is saved as a file named update.xml and sent via curl with the following command:
curl -k -F "reqxml=<update.xml" "https://ip of router here:4444/webconsole/APIController?"

Curl man page: https://curl.haxx.se/docs/manpage.html
Look for -F and you will find this: This causes curl to POST data using the Content-Type multipart/form-data according to RFC 2388
The < indicates to Curl that it should send the contents of the file named update.xml for the "form field" called "reqxml"

The XML probably still needs some tweaking as the update removed the firewall rule from the group that it was in...

Hopefully this helps, maybe the key is to make sure your sending the XML as form-data?  I will be tackling this from PowerShell next as I have some windows servers that will be using PowerShell to retrieve a cert from Let's Encrypt then upload and modify the firewall rule...

Hi JamieBah1, thank you for the response. 

I actually got the same result using curl or postman. 

After which I cleared the exception part of the rule. After that all worked just fine. 

The exception section was left there from getting it all to work and not needed. 

Though it looks like there is some mapping issues within the api controller. 

Thanks for you help.