Firewalls: FortiGate, Cisco ASA and Firepower

Use a NeverLapse certificate for SSL VPN, remote access VPN or the admin web page on your firewall.

Before you start

1. Issue the certificate in NeverLapse for the name users connect to, for example vpn.example.com (see Add and issue certificates). DNS validation means the firewall doesn't need to be reachable from the internet for this.
2. Make sure that name points at the firewall's outside address in public DNS.
3. Get the certificate out of NeverLapse in the form the firewall wants:
   • PFX (PKCS#12) for FortiGate, ASA and FMC: on the Certificates page, open the certificate's … menu > Download PFX, and choose a password for the file. The PFX holds the certificate, its private key and the issuing chain.
   • PEM files for FDM: on the NeverLapse server, in C:\ProgramData\NeverLapse\Certs\<name>\, you'll find cert.pem (the certificate), chain.pem (the intermediate), fullchain.pem (both) and privkey.pem (the private key, unencrypted). Reading them needs administrator rights on that server.

Name each import with the date, for example vpn-2026-10. Firewalls don't let you overwrite a certificate that's in use, so each renewal is imported under a new name, switched over, and the old one deleted. Dated names keep that tidy.

Fortinet FortiGate (FortiOS 7.x)

Import

1. Go to System > Certificates > Create/Import > Certificate.
2. Choose Import Certificate, type PKCS #12 Certificate.
3. Upload the .pfx, enter its password, and give it a name such as vpn-2026-10. Click Create.

CLI alternative: execute vpn certificate local import tftp <file.pfx> <tftp-server> p12 <password>.

Use it

• SSL VPN: VPN > SSL-VPN Settings > Server Certificate > pick the new certificate > Apply. CLI:

  config vpn ssl settings
      set servercert "vpn-2026-10"
  end

• Admin web page: System > Settings > HTTPS server certificate. CLI:

  config system global
      set admin-server-cert "vpn-2026-10"
  end

Test from outside with a browser or FortiClient: the padlock should show your name and a valid chain. If a client reports an incomplete chain, also import the intermediate: Create/Import > CA Certificate with chain.pem.

After each renewal

Import the new PFX under a new name, point SSL VPN (and the admin page) at it, test, then delete the old certificate (System > Certificates, select it, Delete; FortiOS refuses while it's still in use, which is a handy check).

Cisco ASA

Import with ASDM

1. Configuration > Device Management > Certificate Management > Identity Certificates > Add.
2. Trustpoint name: VPN-2026-10. Choose Import the identity certificate from a file (PKCS12 format with Certificate(s) + Private Key).
3. Enter the PFX password, browse to the file, click Add Certificate. ASDM imports the certificate, the key and the issuing CA in one go.

Import with the CLI

The ASA wants the PFX as base64 text. On a Windows machine:

certutil -encode vpn.example.com.pfx vpn.b64

(or openssl base64 -in vpn.example.com.pfx -out vpn.b64). Then on the ASA:

crypto ca import VPN-2026-10 pkcs12 <pfx password>
  (paste the contents of vpn.b64, including the BEGIN/END lines)
quit

Answer yes when asked to accept the CA certificate. Check with show crypto ca certificates VPN-2026-10.

Use it

ssl trust-point VPN-2026-10 outside
write memory

That covers AnyConnect / Secure Client SSL VPN and ASDM on the outside interface. In ASDM the same setting is Configuration > Remote Access VPN > Advanced > SSL Settings > Certificates (edit the interface). For IKEv2 remote access, also set the certificate on the connection profile / crypto ikev2 remote-access trustpoint VPN-2026-10.

After each renewal

Import the new PFX as a new trustpoint (VPN-2026-12), switch ssl trust-point to it, write memory, test, then no crypto ca trustpoint VPN-2026-10.

If the import fails with a decryption or "PKCS12" error on an older ASA image, the PFX's encryption is newer than the ASA understands: re-package it with OpenSSL's legacy settings, then import that file:

openssl pkcs12 -in vpn.pfx -out vpn.pem -nodes
openssl pkcs12 -export -legacy -in vpn.pem -out vpn-legacy.pfx

Cisco Firepower (FTD) managed by FDM

For an FTD managed on the box itself with Firepower Device Manager. FDM takes the certificate and key as PEM.

Import

1. Objects > Certificates > + > Add Trusted CA Certificate: name it LE-intermediate-2026-10, paste or upload chain.pem. Save.
2. Objects > Certificates > + > Add Internal Certificate > Upload Certificate and Key.
3. Name: VPN-2026-10. Server certificate: paste or upload cert.pem. Certificate key: paste or upload privkey.pem. Save.

No access to the NeverLapse server? Split the PFX with OpenSSL instead:

openssl pkcs12 -in vpn.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in vpn.pfx -cacerts -nokeys -out chain.pem
openssl pkcs12 -in vpn.pfx -nocerts -nodes -out privkey.pem

Use it

• Remote access VPN: Device > Remote Access VPN > View Configuration > edit the connection profile's global settings > Certificate of Device Identity = VPN-2026-10.
• FDM's own web page: Device > System Settings > Management Access > Management Web Server > Web Server Certificate.

Then Deploy (the deploy icon at the top right). Nothing changes on the device until you deploy.

After each renewal

Add the new certificate under a new name, switch the VPN (and web server) to it, deploy, test, then delete the old certificate object and deploy again.

Cisco Firepower (FTD) managed by FMC

For FTDs managed by Firepower Management Center (Secure Firewall Management Center). The certificate goes into an enrollment object, the object is enrolled on each device, and policy references it.

Import

1. Objects > Object Management > PKI > Cert Enrollment > Add Cert Enrollment.
2. Name: VPN-2026-10. On CA Information, set Enrollment Type to PKCS12 File, upload the .pfx and enter its passphrase. Save.
3. Devices > Certificates > Add: pick the FTD, pick the VPN-2026-10 enrollment, click Add. The status turns green with ID and CA once the device has it (repeat for each FTD that needs it).

Use it

• Remote access VPN: Devices > Remote Access > edit the policy > Access Interfaces tab > SSL Global Identity Certificate = VPN-2026-10 (and IKEv2 Identity Certificate if you use IKEv2). Save.
• Then Deploy > Deployment, tick the FTDs, Deploy.

After each renewal

Create a new enrollment object with the new PFX (VPN-2026-12), add it under Devices > Certificates, switch the remote access policy to it, deploy, test, then delete the old certificate from the device and the old enrollment object.

Check it from outside

Whatever the firewall, test from a machine outside your network:

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com < NUL

(< /dev/null on Linux or macOS). Look for your name in subject, your CA's intermediate in the chain, and Verify return code: 0 (ok). A browser padlock with the right name and dates tells you the same.