Renew SSL certificate for email on XG Firewall

How did you replace / upload the new one? It needs to have the private key. Or did you do a CSR? 

Could it be that you have a WAF rule that uses this SSL Cert?

If so, point it to new cert.

When it was done first 2 years ago, I selected the .pem file and the .key file entered the password and the SSL upladed to the XG. Then within the configurartion of MTA Email TLS section I was able the select the named SSL cert


Now that there is a new one (old one expires in 2 weeks), I tried to load the new cert to existing, but it said a rule was using it (Email TLS section). So, I then uploaded the new one with a new name. I selected the .pem and entered the password and it uploaded successfully. The .key files was not needed as i have read that the .key will already be uploaded to the XG


Hope this helps

I tried to point to new cert, but it does not appear in the drop down list within MTA Email, TLS section

Likely you uploaded simply a PEM without Private Key. Why should the Key be present? Can you use CSR with GoDaddy? This should be much easier. 

When I used the .key file, it said unrecognised format. Yet using the same .key file with the original .pem giving it a new name, it uploaded alright. Of course, that is just a duplicate of the one that will expire in 13 days.

So, 2 years after the first cert was provided by goDaddy a new one is available to use and goDaddy provided just the .pem file. So, how should i use this .pem file to get it to upload to XG and be selectable to use?

Many thanks

What section specifically? SMTP, POP/IMAP?

That is odd, i mean. They provide you a PEM and no Key. This means, the assume, you have the old Key? 

I would expect a CSR. Can you check, they expect you to do a CSR. 

Email, General, SMTP TLS Configuration, TLS Certificate drodown

That is correct, there are actually 2 files a .pem file and a .crt file named the same