[LetsEncrypt] How To in Sophos Firewall

Added Sophos Factory to this Thread. 

This Feature was one of the top ranked Requests in Ideas (rip).

On every corner in the Forums people ask for it.

The feature was promised the same time it was for UTM. UTM has it for years now - and XG it is still "on the Roadmap" with no sign of anybody even touching it.

Just another Feature, the "next gen" does not have - and likely will not get any time soon. 

Sophos' communication on development and feature implementation in xg is getting to a point where it is embarrassing at best - fraudulent at worst.

Because having to use an external tool is at least one more step as it was with the UTM, where it - apart from accepting new EULAs recently - never made any problems at all.

For me it is not a critical feature at all, but I can understand everyone that is frustrated that it is still not implemented after years of requesting it. The XG/XGS/Sophos Firewall system is evolving, many things have gotten easier (and some harder) to use. But sometimes it still feels like taking part in a beta program rather than having the "state of the art" product.

It can't be this hard to implement a silly simple feature like LetsEncrypt the way it was in the good old UTM. Click a checkbox, enter a FQDN and select an interface. "Save and forget about it".

this - and the usual "will be implemented by next version" answer by Sophos.

And Factory is a fun toy - if you have a few connected instances.
but GL implementing and managing 300 Customers with independent Firewalls.

For me it is not a critical feature. But as we have multiple customers with at least 100 WAF instances using LE-Certs - on over 30 Firewalls, and the current state of missing features in XG's WAF - all those will not migrate to XG, as this would mean to have a separate reverse proxy appliance/vm to replicate what UTM can do

Factory is actually a tool to scale up to enterprise customers. It is a tool to work with thousand of customers at once. Did you try out the way factory work? Because you can build a pipeline and use per customer own creds and reuse the pipeline 300 times - No worries. So it would be possible to do this 300 times and much more. I am seeing factory as the new way of intergrating and working as a partner and every partner should invest time into this way of working compared to "the old fashion way". 

LE is not be part of the near future roadmap. There is no commitment to do it in the next version by any means. Customers are looking into buying a cheap wildcard cert and use it in the mean time. I would not see WAF certificate management as a blocker for doing a migration for any reason. This is something, which we can easily solve by two ways: Use a tool like factory (customer or partner) or purchase a certificate. This cannot be a blocker for migration - and if it is a blocker, feel free to contact your Sophos sales Rep to discuss the option there. (Maybe a virtual UTM for WAF for example). 

Thx for saying that Sophos is not listing to there customers. We have 30 Rules on the WAF. Changing the Certificate is a pain. LE would be really great. No, we dont want another system running we have to take care ...

At the end of the day, it's just ridiculous that Sophos refuses to add such a simple feature. And your suggestion is to run a virtual UTM? Come on. Most of your competition supports LE and has for awhile. Wildcard certs are not cheap and that is just something else for end users to worry about, when the simple solution is to add the feature.

That is not my point. LE is on the backlog but other features are more pressuring to be implemented compared to LE, which is easily replacable.

BTW: You can easily change it with XML Import/export.

And as you can see, LE alone would not work - You need a change in the entire certificate management of SFOS ( core ), which means, it needs to replace the certificate completely transparent in all modules. 

The next question is: Are we going to do the old HTTP integration, which is likely unsecure compared to DNS. So the way to integrate this future proof would be to do the DNS Challenge. DNS Challenge means, you would have to host a own DNS server or support a DNS Service with API hooks. This is the next challenge. 

Just to give you an overview of the decision making. 

No, its not easy to do with XML. If you do it regular possible, but not for the normal customer ...

See: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/123684/interface-vlan-migration-via-xml-import-export It is the same for WAF. I can create a Recommended Read for this, if needed. But you can do this in 1 minute, if you want. 

LuCar Toni said:

So the way to integrate this future proof would be to do the DNS Challenge. DNS Challenge means, you would have to host a own DNS server or support a DNS Service with API hooks. This is the next challenge. 

Where did you got this information from?

As long as your domain registrar have a API to manage subdomains records, It will work as expected with the correct certbot plugin. (Which means all top registrars including Cloudflare are able to do this.)

Example: certbot-dns-cloudflare.readthedocs.io/.../

You can do both. But the problem is: Most DNS Provider does not offer a API. The big one does, but there are plenty of DNS Providers (especially the smaller) without a API. So using DNS Verification will not work for those customers. What is the alternative? Using HTTP or do a DNS Server implementation: See: https://github.com/joohoi/acme-dns

You can do both. But the problem is: Most DNS Provider does not offer a API. The big one does, but there are plenty of DNS Providers (especially the smaller) without a API. So using DNS Verification will not work for those customers. What is the alternative? Using HTTP or do a DNS Server implementation: See: https://github.com/joohoi/acme-dns

The software is already available, It's code is open-source under a MIT license and the industry knows It works.

At least, It's better to support the big DNS providers which most Sophos customers should be using than no one.

I would guarantee, most customers are not using the big DNS vendors. Because most customers i am talking right now, are NOT using those API vendors. Lets rephrase this: @Björn Bendix / MichaelBolton / Dominik Klaer kerobra Which DNS Provider do you / your customers are using? Would a API based DNS Challenge work? 

Schlundtech, yes they have API. But i would prefer HTTP ;)

GoDaddy and Cloudflare. Both have API's.

Just wondering: Why not doing it API based with DNS and Certbot? It would be an ease to do like above described. But this conversation loops again. I am doing this for all my firewalls with AWS API. But most customers are using (local) German API vendors, i am talking to. 

Its very easy, keep it simple

Because we want the firewall to do it. What don't you understand? Again, the most requested feature for XG. We don't care that Sophos "needs a change in the entire certificate management of SFOS ( core )" this should have been done long ago. Back to V16. I'm done with the back and forth about this. You see what the customers and end users want. We have asked for years. Stop making excuses and make it happen. Support HTTP and DNS and let the end user chose.

I do not understand, why the firewall should be part of the work of being a certificate store. But i am from the old school of having a separate service for such tasks. And i am a fan of automate such task for multiple instances at once. 

Again: I am not a Product Manager nor do i have influence on the roadmap or any other topics. I am here to help and give advice. 

If you want to prioritize this, feel free to reach out to your local Sales rep to get sorted out. 

I cannot comment on this any further. 

SFOS has a WAF, that's why. UTM supports it. Put your products on feature parity. It's simple. Cleary if UTM has it, someone at Sophos thought it was an important feature and can see the need for a firewall to handle the certificates of the websites that use it's WAF.

So you will need Webserver Protection Licenses for LE? That would be requirement to get this to work. And most customers, i am talking to, are not licensing WAF anymore. (Only if Exchange on Prem is present). 

Again: If you have a business case and a customer needing this feature, you can contact Sales to get the prioritization right. I am not seeing much LE requests from customer lately. 

I am more in implementation of ZTNA lately, and ZTNA need a wildcard certificate, which means, it needs DNS LE Challenge as well.