Thread Info
  • State Not Answered
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Subscribers 32 subscribers
  • Views 1388 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LetsEncrypt Functionality WAF

MatthiasLang

Hello all

at the moment I use Sophos UTM and WAF with LetsEncrypt.
The funktion in UTM is running well and easy.

In the near future I want to migrate to Sophos XG.
My question is, is it planned in the near future to integrate LetsEncrypt in Sophos XG?

For me LetsEncrypt functionality in WAF is a essential feature. 

I will not switch as long as the integration is not there :-/



This thread was automatically locked due to age.
Parents
  • 0

    As this feature is not implemented yet, there are several question to be asked:

    For which feature do you need the LE certificate?

    Can you run a own server behind the Firewall, which could compensate the LE handling?

    Is this the only blocker for your migration?

    As this feature can be workaround with a third party LE handler (like certbot) and be automated via API, it could be easily integrated on your environment, if needed. 

  • 0 in reply to LuCar Toni

    Will the feature ever be implemented for the XG? I don't understand why Sophos has integrated this feature in the UTM but no longer tracking it on the XG.
    Yes it should be possible to implement a separate server for the LE handling. However, I find this way a bit cumbersome if I am honest. Unfortunately, then again a server is available that must be maintained.

  • 0 in reply to MatthiasLang

    Why do you need this feature in the first place? I cannot comment on the future roadmap.

  • 0 in reply to LuCar Toni

    Why?  Because this greatly simplifies and centralizes setting up WAF auto-renewing certificates in front of hosted web services, without having to mess with certs and LetsEncrypt on the web services themselves.  Admins can easily leave the internal web services with extended self sign certificates, or even add tls to plain unencrypted services, some of which can be complicated to work with.  This is now extra important for the current 1yr max cert limitation for many mobile devices and browsers.  Even going out to buy a 3rd party public cert can mean updating on multiple servers every year, and we have better things to do with our time, hence further love for LetsEncrypt and UTMs integrated feature.

    Yes various 3rd party scripts can be used, but then this has to done and managed on multiple servers, which in many cases can be quite frustrating and hard to troubleshoot.  Same issue with using a 3rd party script to update certs on xg via api.  This should be totally unnecessary in 2021 as has been pointed out time and time again. 

  • 0 in reply to RaveNet

    Hello RaveNet, I agree that is it strange that Sophos (or his representative) is asking to something so obvious?

    Joy

    Regards

    alda

Reply Children
No Data