FMC: Automatic renew certificates?

[Network Diver]

Hello,

Managing certificates is getting more and more a nightmare as the valid lifetime will be reduced to 47 days, especially on devices and virtual appliances that don't support any kind of automatic renewal protocol.

What are the options in FMC to automatically renew VPN peer certificates signed by an external public CA? Currently FMC 7.4 only supports EST and SCEP enrollment. [1] None of them supports automatic renewal. Also latest FMC 7.7 does not support ACME. We also use the VPN peer certificate for signing SAML requests for Microsoft EntraID, so renewing a certificate for a VPN peer involves multiple manual steps.

[1] https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/objects-certs.html

[2] https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/770/management-center-device-config-77/objects-certs.html

[Network Diver]

Any outlook when FMC will support ACME for certificate renewals?
There's an enhancement request for this: https://bst.cisco.com/quickview/bug/CSCvi00886

[MHM Cisco World]

Thanks for sharing 

Have a nice day 

MHM

[Marvin Rhoads · Accepted solution]

ACME-based certificate renewal support for FMC-managed FTD devices is expected to be introduced later this year (2025) with the next major release (10.0). It is already present and working in the latest ASA code and the FMC support builds on that same foundation.

[kajtzu]

I agree that the ASA code in 9.23(1) and later works but it installs only the requested certificate, not any intermediates, which means the certificate chain is incomplete. So, it doesn't work unless the client is able to use AIA fetching. The ones that don't support it complain about the cert. I have a case open for this, actually.

[Marvin Rhoads]

@kajtzu Good point - I have also brought up this issue with the Cisco team during FTD beta testing. We will see if they are able to incorporate the intermediate certificate(s) sooner vs. later. Behind the scenes it's a simple chaining operation that can be done in openssl.

[ega1]

May I ask the status of your case with the incomplete chain?

[kajtzu]

I think there is an enhancement request, check CSCwt51116 on BTS.

[Marvin Rhoads]

That ENH was added due in part to my request for it during beta testing. Over a year later and we are still waiting... Never hold your breath waiting on ENH. Many die quietly in the backlog queue.
I have found that if you manually install the certificate(s) between your CA's well-known root and the device certificate manually as CA-only certificate trustpoints on the device, they will be presented to requestors who look for them. That may satisfy some requirements.

[kajtzu]

Agreed.

The "install manually workaround" thing is not good enough as ACM and LE both give more or less random intermediates when renewing, unfortunately. 

[Marvin Rhoads]

The half dozen or so VPN certificates I have received from LE all seem to be issued by their YR1 or YR2 intermediate. So, I have adjusted my procedure to just include both of those as enrolled trustpoints.

[Network Diver]

We're using the VPN peer certificates also for SAML identity provider certificate for Microsoft Entra SSO. Will that also work with ACME renewal process?

The public CA we're using always want's a new private key. So far the cert enrollment on FMC 7.6 doesn't show an option to regenerate a new private key with each enrollment. I think I haven't seen t his option either on FMC 10.

[Network Diver]

I wonder which ACME challenges FTD/FMC 10.x will support and whether automatic enrollment works for VPN peer certificate, FMC admin certificate and service provider certificate used by Azure Entra SSO.

• ACME HTTP-01 and TLS-ALPN-01 could work for firewalls acting as VPN peers that are accessible from the internet and from the registrar's ACME service to verify the token. But our management center is in the internal network.
• ACME DNS-01 challenge could work for devices that are not accessible from the internet such as the FMC, but we're currently using DNS delegation with Azure DNS and Certbot Azure DNS plugin and grant only write access to TXT records in acme DNS subdomain referenced by _acme-challenge.<hostname> CNAME.

[davidwarner11tt]

With certificate lifetimes dropping to 47 days, manual renewal will quickly become difficult to manage. If FMC still doesn’t support ACME, the best workaround is to automate renewal externally and script the import/deployment steps in FMC. A Cisco feature request for native automated renewal would also make sense here.

[Network Diver]

Probably when AI bots take over the internet, the certificate lifetime will be reduced again to 47 nanoseconds.