This guide provides a detailed, technical walkthrough for replacing the SSL certificate on a Cisco Firepower Threat Defense Virtual (FTDv) device, using Cisco Firepower Management Center (FMC).
Prerequisites
Cisco FMC (Firepower Management Center)
Cisco FTDv (Firepower Threat Defense Virtual)
DigiCert-issued SSL certificate Corresponding (or from your CA)
Private Key
DigiCert Global Root G2 certificate Certificate (or from your CA)
Generation Tool: Certtools.netsec.us
Step 1: Generate PFX/P12 Certificate
Access Certtools.netsec.us.
Input the following elements in this exact sequence:
—–BEGIN PRIVATE KEY—–
(Your private key content)
—–END PRIVATE KEY—–
—–BEGIN CERTIFICATE—–
(Your DigiCert-issued certificate)
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
(DigiCert Global Root G2 certificate)
—–END CERTIFICATE—–
Select PEM as the export format.
Click “Generate PKCS12 / PFX”.
Download the generated certificate file, rename the extension to .pfx (e.g., ftdv_cert.pfx).
Step 2: Import Certificate to Cisco FMC
Log in to Cisco FMC web interface.
Navigate to: Devices → Certificates Click “Add Certificate” and select “PKCS12 File”.
Upload the previously generated .pfx file.
Enter the mandatory password: Cisco123
Complete the upload process and verify successful certificate import.
Step 3: Configure a New Trustpoint in FMC In FMC, navigate to: Devices → Certificates → Add New Trustpoint
Configure the following: Trustpoint Name: Provide a meaningful identifier (e.g., DigiCert-FTDv-Trustpoint).
Associate the newly uploaded certificate.
CRITICAL: During trustpoint creation, ensure the option below is explicitly enabled to bypass CA checks: ☑ Skip Check for CA flag in basic constraints of the CA Certificate
Click “Save”.
Step 4: Apply Trustpoint to Cisco FTDv Device
On FMC, navigate to: Devices → Device Management Select your Cisco FTDv device and click “Edit”.
Navigate to: Advanced → SSL Settings From the dropdown menu, select your newly created trustpoint (e.g., DigiCert-FTDv-Trustpoint).
Click “Save”, then deploy the configuration by clicking “Deploy” to push the changes.
Step 5: Verification
Restart your browser or use an incognito/private window.
Access your Cisco FTDv via HTTPS and confirm: Certificate validity Correct CA hierarchy and trust establishment via browser security details
Troubleshooting Tips
If issues occur: Verify the precise sequence of certificate/key insertion during PFX generation.
Confirm the .pfx file password (Cisco123).
Ensure the “Skip Check for CA flag” option is correctly enabled.
Always deploy changes via FMC after modifications.
Following these steps accurately will enable a seamless SSL certificate replacement on Cisco FTDv through Cisco FMC.