SonicWall SonicOS

Firewall and VPN

Installs a certificate and key on SonicWall and selects it for HTTPS management and SSL VPN.

What happens

The appliance connects to SonicWall SonicOS through SonicOS API on port 443.
The package imports the certificate and key as PKCS12. SonicOS 7 and later must accept multipart certPasswd/certificate.exp in the request body; the password is never sent in a URL.
The certificate is selected for HTTPS management and/or SSL VPN according to the rule, and the changes are saved. If it fails: Rollback puts back the certificate each selected use had before deployment.
Verification: the package reads back certificates and selected uses and checks the certificate the management port serves over TLS.

Connection: The package runs on the appliance, which connects over HTTPS to SonicOS API, port 443. No agent is installed.
Service ports: 443
You need: Enable the SonicOS API and Basic login. Use an account with access to certificates and the selected uses. The password must contain 12-256 ASCII characters: A-Z, a-z, 0-9 or _.:+=,/-.
Platform: SonicOS 6.5.4 and later for discovery and verification; 7.0 and later accepting body-password import for deployment
Actions: Discovery, Installation, Verification, Rollback
Packages: sonicwall-sonicos-api 1.1.0
Note: Older firmware can refuse body-password import, leaving services unchanged. SonicOS 6.5 supports discovery and verification only. A certificate identified as native ACME is not taken over automatically; import without that binding and move the selection on SonicWall. A required restart is reported, never performed.
Rollback needs the deployment state and the previous certificate. It refuses later changes and deletes no certificates. SSL VPN is checked by reading back its selection, rather than by a VPN connection.
Discovery finds certificates, HTTPS management, SSL VPN and the management port TLS certificate.
The firewall is not restarted. No service agent is installed on the device.