1

Hello All,

So recently I posted here in regards to initiating a CSR from the firebox and then completing that on the go daddy side. The certificates have now been installed. What I am trying to achieve is allowing my user to have a secure connection (well signed secure connection) for my users connecting from their ssl VPN client.

How do I go about assigning this certificate specifically to the SSL VPN. Where is this done in the watchguard? The only option i’ve seen while looking online and researching is from the web server certificate tab and the current option is default certificate signed by firebox and then I see 3rd party certificate with my cert (not selected greyed out).

My question is now that the certs have been installed how do I assign it to the vpn. that my users will be connecting to? My apologies if this does not make sense, but I am entirely new to this process.

Currently the way it sits I see my new cert installed. But I am not sure of the next step. Any assistance would be much appreciated, I’m pretty solo here.

Thank!

4 Spice ups
2

You may want to contact Watchguard support directly.

My understanding is that the SSLVPN certificate cannot be replaced because of an integrated security message for the Mobile VPN client that relies on the certificate.

3

“The only option i’ve seen while looking online and researching is from the web server certificate tab and the current option is default certificate signed by firebox and then I see 3rd party certificate with my cert…”

Choose your cert as the new server cert. It covers the port 4100 login page, the SSLVPN web login page, and the SSLVPN itself.

Gregg

2 Spice ups
4

Gregg,

You are the man. I am going to set this up today. I just did not want to lose access to the watchguard log in.

5

This is why I was suggesting contact watchguard directly. The warning is at the bottom of the page : About the Mobile VPN with SSL Security Alert

1 Spice up
6

Actually can you clear something up for me before I make the change. Although I requested the CSR from the watchguard my cert is bound to vpn.domainname.com.

When I make that change isn’t that going to break the log in? Only because this cert isnt going to firebox.domainname.com its going to vpn.domainname.com.

Let me know when you can again, sorry this is my first time ever setting this up.

7

You are missing the point of " It is not possible to import custom SSLVPN certificates…"

There is no need to import a “custom SSLVPN certificate” because, as that article states, “If you do not want users to see this security alert, you can configure a valid certificate for the web server on your Firebox.”

As I said, that web server cert covers the port 4100 login page, the SSLVPN web login page, the SSLVPN itself…and the web UI page, too.

Gregg

2 Spice ups
8

Just use vpn.domainname.com to reach the login pages (4100, SSLVPN, web UI) and as the SSLVPN target instead of using firebox.domainname.com to reach it.

Gregg

1 Spice up
9

Thanks for clearing that up. I was considered that making that change would no longer allow me to access the firebox via ip. Its just that will the unsecure and if I were to connect using the vpn. it would be secured correct?

Thanks!

10

Even using the self-signed certs, the connections are all still secure. The difference is that with self-signed certs, the TRUST of that security is unknown, so it pops the warning message. The connections are still encrypted.

Accessing by IP will give a warning, but again, the connections are still encrypted.

Gregg

11

BTW, did GoDaddy have PFX file downloads?

Gregg

12

Gregg they did not they recommended some sort of converter.

13

Hey Gregg,

So if I made the swap and cannot access the vpn. while internal here in the office what am I missing? I feel like I am missing an A record but I cant have vpn. pointing to the firewall and the actual hostname of the fw pointing to the same IP correct? This definitely has to be a DNS issue somewhere.

14

How are you trying to access the firewall with the SSLVPN client - by IP addr or by DNS name ?

Wht do you see in Traffic Monitor when this access is tried ?

You can turn on diagnostic logging for SSLVPN which may show something to help:

In WSM Policy Manager: Setup → Logging → Diagnostic Log Level → VPN → SSL

In the Web UI: System → Diagnostic Log

Set the slider to Information or higher

15

I don’t understand what you mean by “but I cant have vpn. pointing to the firewall and the actual hostname of the fw pointing to the same IP correct?”

You should be able to create DNS records of any names you desire and point them at any IP you desire. You could have bubba.domainname.com and sparky.domainname.com and vpn.domainname.com all pointing to the Firebox’ IP address, and they would all reach it, but only vpn.domainname.com would not prompt about an insecure certificate, because that’s the only name you have on your cert. I have a wildcard cert, so all of above names would work without a cert prompt on my Fireboxes.

From an internal system, I can connect to my SSLVPN using vpn.greggsdomainname.net, which has no internal DNS entry so it looks up the WAN IP and connects via WAN IP and loopback.

I also can connect to my SSLVPN using remote.greggsdomainname.net, which does have internal DNS entry, so it looks up the LAN IP and connects via the LAN.

If you ping vpn.domainname.com from an internal computer, what is the response?

Gregg

1 Spice up