{"id":905,"date":"2026-07-14T13:46:12","date_gmt":"2026-07-14T10:46:12","guid":{"rendered":"https:\/\/mangen.kitabara.org\/?p=905"},"modified":"2026-07-14T20:47:04","modified_gmt":"2026-07-14T17:47:04","slug":"how-to-configure-certificates-with-firebox-ikev2-vpn","status":"publish","type":"post","link":"https:\/\/mangen.kitabara.org\/index.php\/how-to-configure-certificates-with-firebox-ikev2-vpn\/","title":{"rendered":"How to configure certificates with Firebox IKEv2 VPN."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">By default, a WatchGuard firewall uses its own <strong>self\u2011signed certificate<\/strong> for IKEv2.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53efe68&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53efe68\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"921\" height=\"335\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-1.png\" alt=\"\" class=\"wp-image-906\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-1.png 921w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-1-300x109.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-1-768x279.png 768w\" sizes=\"auto, (max-width: 921px) 100vw, 921px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> WatchGuard <strong>does not support user certificates<\/strong> for IKEv2 login! The certificate is used <strong>only to encrypt the connection<\/strong> between the IKEv2 client and the firewall, so the username and password can be sent securely \u2014 similar to how HTTPS works on websites.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you use the firewall\u2019s default self\u2011signed certificate and then:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>upgrade to a new firewall device, or<\/li>\n\n\n\n<li>reset Firebox to factory settings<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u2026the Firebox will have a <strong>new self\u2011signed Root CA certificate<\/strong> and any computers that already had a working IKEv2 connection must be updated with this <strong>new Root CA certificate<\/strong>, otherwise IKEv2 will stop working.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can <strong>NOT<\/strong> export the old firewall\u2019s Root CA certificate and import it into the new firewall.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><strong>Best practice<\/strong><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Use a <strong>real, trusted certificate<\/strong> on the firewall and configure IKEv2 to use that certificate. Then you <strong>don\u2019t need to install any certificate<\/strong> on the computers, because they already trust public Certificate Authorities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In Active Directory network<\/strong>s, another option is:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Create a new certificate in the Firebox.<\/li>\n\n\n\n<li>Sign it using Microsoft AD Certificate Services (ADCS).<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Windows AD domain computers automatically trust the ADCS server, so again <strong>no certificate installation is needed<\/strong> on the clients.(WatchGuard\u2019s guide: <a href=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/certificates\/cert_complete_signing_req_c.html\" data-type=\"link\" data-id=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/certificates\/cert_complete_signing_req_c.html\" target=\"_blank\" rel=\"noopener\">signing a certificate with Microsoft CA<\/a>.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this example, I created a new Let\u2019s Encrypt RSA cert in PEM format for <strong>vpn.uchilab.org<\/strong> using <strong><a href=\"https:\/\/simple-acme.com\" data-type=\"link\" data-id=\"simple-acme.com\" target=\"_blank\" rel=\"noopener\">Simple-Acme<\/a><\/strong>. I recommend also checking <strong><a href=\"https:\/\/www.certkit.io\" data-type=\"link\" data-id=\"www.certkit.io\" target=\"_blank\" rel=\"noopener\">certkit.io<\/a><\/strong> for cloud certificate management.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f062f&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f062f\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"320\" height=\"152\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/LetsEncrypt_certs.png\" alt=\"\" class=\"wp-image-910\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/LetsEncrypt_certs.png 320w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/LetsEncrypt_certs-300x143.png 300w\" sizes=\"auto, (max-width: 320px) 100vw, 320px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Download <a href=\"https:\/\/letsencrypt.org\/certificates\/\" data-type=\"link\" data-id=\"https:\/\/letsencrypt.org\/certificates\/\" target=\"_blank\" rel=\"noopener\">Let\u2019s Encrypt Root CA and Intermediate certificates<\/a>.<br>Open in Firebox System Manager \/ View \/ Certificates \/ Import Certificate.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f0a97&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f0a97\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"317\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-2-1024x317.png\" alt=\"\" class=\"wp-image-912\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-2-1024x317.png 1024w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-2-300x93.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-2-768x238.png 768w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-2-980x304.png 980w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/FireboxIKEv2-certificates-2.png 1058w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The Certificate Import Wizard imports:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>certificate<\/li>\n\n\n\n<li>private key<\/li>\n\n\n\n<li>Let&#8217;s Encrypt Intermediate certificate<\/li>\n\n\n\n<li>Let&#8217;s Encrypt Root CA certificate<br><\/li>\n<\/ul>\n\n\n\n<figure data-wp-context=\"{&quot;galleryId&quot;:&quot;6a673f53f0ce5&quot;}\" data-wp-interactive=\"core\/gallery\" class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"513\" height=\"409\" data-id=\"925\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-1.png\" alt=\"\" class=\"wp-image-925\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-1.png 513w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-1-300x239.png 300w\" sizes=\"auto, (max-width: 513px) 100vw, 513px\" \/><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f15e9&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f15e9\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"513\" height=\"408\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"926\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-2.png\" alt=\"\" class=\"wp-image-926\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-2.png 513w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-2-300x239.png 300w\" sizes=\"auto, (max-width: 513px) 100vw, 513px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f19f8&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f19f8\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"511\" height=\"412\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"927\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-3.png\" alt=\"\" class=\"wp-image-927\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-3.png 511w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-3-300x242.png 300w\" sizes=\"auto, (max-width: 511px) 100vw, 511px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f1e0e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f1e0e\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"510\" height=\"413\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"931\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-4.png\" alt=\"\" class=\"wp-image-931\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-4.png 510w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-4-300x243.png 300w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f21c2&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f21c2\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"517\" height=\"409\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"928\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-5.png\" alt=\"\" class=\"wp-image-928\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-5.png 517w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-5-300x237.png 300w\" sizes=\"auto, (max-width: 517px) 100vw, 517px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f25d2&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f25d2\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"515\" height=\"410\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"930\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-6.png\" alt=\"\" class=\"wp-image-930\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-6.png 515w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-6-300x239.png 300w\" sizes=\"auto, (max-width: 515px) 100vw, 515px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f29d2&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f29d2\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"510\" height=\"411\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"932\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-7.png\" alt=\"\" class=\"wp-image-932\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-7.png 510w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-7-300x242.png 300w\" sizes=\"auto, (max-width: 510px) 100vw, 510px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f2dc5&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f2dc5\" class=\"wp-block-image size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"515\" height=\"412\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"929\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-8-1.png\" alt=\"\" class=\"wp-image-929\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-8-1.png 515w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-8-1-300x240.png 300w\" sizes=\"auto, (max-width: 515px) 100vw, 515px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/figure>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f35f1&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f35f1\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"962\" height=\"338\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-9.png\" alt=\"\" class=\"wp-image-933\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-9.png 962w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-9-300x105.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Import-cert-9-768x270.png 768w\" sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">In the Firebox IKEv2 settings, select this new certificate.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f3a16&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f3a16\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"546\" height=\"585\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Firebox-IKEv2-certificate.png\" alt=\"\" class=\"wp-image-938\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Firebox-IKEv2-certificate.png 546w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Firebox-IKEv2-certificate-280x300.png 280w\" sizes=\"auto, (max-width: 546px) 100vw, 546px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">You can also configure the Firebox to use this certificate for example: WebUI, Access Portal,<strong> <\/strong>and other HTTPS connections to the Firebox.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f53f3e99&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f53f3e99\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"555\" height=\"376\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Firebox-Web-certificate.png\" alt=\"\" class=\"wp-image-939\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Firebox-Web-certificate.png 555w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Firebox-Web-certificate-300x203.png 300w\" sizes=\"auto, (max-width: 555px) 100vw, 555px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">If your firewall\u2019s SSLVPN is enabled or HTTPS portals are accessible from the internet, you can test the certificate chain using online tools such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.ssl.org\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.ssl.org\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.sslshopper.com\/ssl-checker.html\" target=\"_blank\" rel=\"noopener\">https:\/\/www.sslshopper.com\/ssl-checker.html<\/a><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f540018a&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f540018a\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"621\" height=\"554\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certificate_chain_test.png\" alt=\"\" class=\"wp-image-940\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certificate_chain_test.png 621w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certificate_chain_test-300x268.png 300w\" sizes=\"auto, (max-width: 621px) 100vw, 621px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">If you use a <strong>real, trusted certificate<\/strong> on the firewall, you <strong>do not need to install any Root CA certificate<\/strong> on the IKEv2 client computers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this example we are using a <strong>Let\u2019s Encrypt certificate<\/strong>, and Windows already includes the <strong>Let\u2019s Encrypt Root CA<\/strong> by default. This means Windows automatically trusts the firewall\u2019s certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can check this on a Windows machine:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Open <strong>certmgr.msc<\/strong><\/li>\n\n\n\n<li>Go to <strong>Trusted Root Certification Authorities<\/strong><\/li>\n\n\n\n<li>You will see the default Let\u2019s Encrypt <strong>ISRG Root X1<\/strong> certificate listed there.<\/li>\n<\/ol>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f540074d&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f540074d\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"869\" height=\"429\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr.png\" alt=\"\" class=\"wp-image-946\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr.png 869w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr-300x148.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr-768x379.png 768w\" sizes=\"auto, (max-width: 869px) 100vw, 869px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>Automatic installation with the Firebox IKEv2 Client Profile<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you use the <strong><a href=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/mvpn\/ikev2\/mvpn_ikev2_client_config.html\" data-type=\"link\" data-id=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/mvpn\/ikev2\/mvpn_ikev2_client_config.html\" target=\"_blank\" rel=\"noopener\">default IKEv2 Client Profile script<\/a><\/strong> from the Firebox to install the VPN settings, the script will <strong>automatically install the Firebox CA certificate<\/strong> on the computer. So, in most cases, you do not need to install it manually.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Installing the Firebox CA certificate with AD GPO (or Intune)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can also deploy the Firebox CA certificate through <strong>Active Directory Group Policy<\/strong> or <strong>Intune<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AD GPO path:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Computer Configuration \u2192 Policies \u2192 Windows Settings \u2192 Security Settings \u2192 Public Key Policies \u2192 Trusted Root Certification Authorities<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Right\u2011click in the window, choose <strong>Import<\/strong>, and select the <strong>Firebox CA certificate<\/strong>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f5400d37&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f5400d37\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"761\" height=\"264\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO-certificate-1.png\" alt=\"\" class=\"wp-image-948\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO-certificate-1.png 761w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO-certificate-1-300x104.png 300w\" sizes=\"auto, (max-width: 761px) 100vw, 761px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">You can check this on a Windows machine:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Open <strong>certmgr.msc<\/strong><\/li>\n\n\n\n<li>Go to <strong>Trusted Root Certification Authorities<\/strong><\/li>\n\n\n\n<li>You will see the default Firebox <strong>Fireware IKE<\/strong> certificate listed there.<\/li>\n<\/ol>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f54011ed&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f54011ed\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"868\" height=\"334\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr-2.png\" alt=\"\" class=\"wp-image-949\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr-2.png 868w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr-2-300x115.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/certmgr-2-768x296.png 768w\" sizes=\"auto, (max-width: 868px) 100vw, 868px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>Where to get the Firebox CA certificate<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can find the Firebox CA certificate in two places:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Inside the <strong>IKEv2 Client Profile file<\/strong> you downloaded from the Firebox<\/li>\n\n\n\n<li>Or export it directly from <strong>Firebox System Manager \u2192 Certificates<\/strong><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f54016e3&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f54016e3\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"303\" height=\"176\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Client-Profile.png\" alt=\"\" class=\"wp-image-950\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Client-Profile.png 303w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Client-Profile-300x174.png 300w\" sizes=\"auto, (max-width: 303px) 100vw, 303px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Firebox supports wildcard certificates too. If you use the IKEv2 Client Profile script, you must edit the <strong>AddVPN.ps1<\/strong> file (found in the <strong>\\Windows\\ps<\/strong> folder).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When a wildcard certificate is used, the script sets the ServerAddress incorrectly:<br>-ServerAddress &#8216;*.uchilab.org&#8217;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Change it to the correct server address:<br>-ServerAddress &#8216;vpn.uchilab.org&#8217;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a673f5401bfa&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a673f5401bfa\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"954\" height=\"268\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AddVPN_ServerAddress.png\" alt=\"\" class=\"wp-image-958\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AddVPN_ServerAddress.png 954w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AddVPN_ServerAddress-300x84.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AddVPN_ServerAddress-768x216.png 768w\" sizes=\"auto, (max-width: 954px) 100vw, 954px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>By default, a WatchGuard firewall uses its own self\u2011signed certificate for IKEv2. Important: WatchGuard does not support user certificates for IKEv2 login! The certificate is used only to encrypt the connection between the IKEv2 client and the firewall, so the username and password can be sent securely \u2014 similar to how HTTPS works on websites.&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,16,5,4,2],"tags":[],"class_list":["post-905","post","type-post","status-publish","format-standard","hentry","category-authentication","category-certificates","category-ikev2","category-vpn","category-watchguard"],"_links":{"self":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/comments?post=905"}],"version-history":[{"count":25,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/905\/revisions"}],"predecessor-version":[{"id":959,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/905\/revisions\/959"}],"wp:attachment":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/media?parent=905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/categories?post=905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/tags?post=905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}