WatchGuard Firebox

Firewall and VPN

Renews local Firebox certificates through SSH; the Cloud API uploads and installs, with certificate selection in the Cloud UI.

What happens

The appliance connects locally over SSH 4118 with a pinned host key or to the regional WatchGuard Cloud API over HTTPS 443.
Locally, certificate fingerprints and previous role selections are read before import. The package transfers PKCS12 through the SSH tunnel and selects it for Web Server and optionally IKEv2. If it fails: If WebUI answered before and stops answering afterwards, the Web Server selection is restored while it still points to this deployment.
Cloud uploads and installs on one device only with WATCHGUARD_CLOUD_INSTALL=true. Then select the certificate manually in the WatchGuard Cloud UI.
Web Server verification requires the served SHA-256 on WebUI, normally port 8080. IKEv2 is checked only through local configuration selection. Cloud verification needs WATCHGUARD_WEB_UI_HOST.

Connection: The package runs on the appliance. Local: SSH 4118 and WebUI HTTPS 8080. Cloud: HTTPS 443 to api.usa|deu|jpn.cloud.watchguard.com.
Service ports: 4118, 8080
You need: Locally, use a Device Administrator, WATCHGUARD_SSH_HOST_KEY_SHA256 and SSH remote forwarding. Cloud requires an API key and read-write access ID.
Platform: Local: Fireware 12.x or 2026.x. Cloud: Firebox Management API
Actions: Discovery, Installation, Verification, Rollback
Packages: watchguard-firebox
Note: Local rollback can restore previous role selections from retained state while the roles still use the deployed certificate. A previous custom Firebox-signed Web Server certificate cannot be selected again. Cloud rollback changes nothing because the API did not select the certificate.
No certificate switch is made without unambiguous fingerprints and readable role selections. Local installation without a WebUI response reports configuration verification only. The package never restarts the Firebox or deletes certificates. A local Firebox that only reports to Cloud uses the local profile.
Local import uses one-time passwords in the Fireware CLI. Fireware can retain them in its command history; protect access to the device’s history and logs.