We manage roughly 50 WatchGuard firewalls at different sites, each with manually installed TLS certificates. WatchGuard still does not provide the certificate automation we need, so renewals are a recurring administrative burden.
Our certificate provider, Namecheap, sold us certificates with 365 days of service, but the certificates themselves are now limited to about 200 days because of industry rules. When the first batch began expiring, the management portal displayed a shopping-cart icon suggesting that we needed to purchase new certificates. It did not clearly explain that we could reissue the certificates and use the remaining paid term—in this case, roughly 165 days.
Support eventually confirmed that reissuing or rekeying the certificates would preserve the remaining time, but only after I opened a ticket and provided screenshots of the confusing interface. The certificate search tools are also poor, which makes managing hundreds of certificates unnecessarily difficult.
Has anyone using larger providers such as DigiCert, GlobalSign, or GoDaddy found their handling of reissues and remaining purchased time to be clearer? Are providers making this transition easier, or is the real answer to move to automated ACME-based certificates?
4 Answers
There are automation approaches for WatchGuard, including scripts that retrieve certificates through ACME and install them using the appliance’s remote-management or file-transfer functions. That is much better than manually replacing 50 certificates every few months.
Plan the rollout in stages, keep the private keys protected, and monitor both certificate issuance and successful installation. If you issue many certificates under one domain at once, check the provider’s rate limits and stagger the initial deployment.
You paid for a year of service; the shorter certificate lifetime is an industry limit, not a reason to buy a second certificate. A reissue or rekey should let you use the remaining portion of the original order. Namecheap may technically support that, but presenting a large purchase button instead of the reissue option is definitely confusing.
DigiCert and some of the larger providers generally make the remaining term more visible, though the workflow still varies. I would track the order term separately from the current certificate expiry, and consider switching providers only if reissues continue to be difficult or hidden.
This is also complicated when SANs are added during a reissue, since the replacement certificates can end up with different expiration dates. Automation is the long-term fix, but keeping an inventory of orders, certificates, devices, and renewal status helps in the meantime.
The larger providers are not necessarily solving the underlying problem. Some use annual licenses or certificate inventories that allow repeated reissues during the paid term, and DigiCert users generally report that the replacement certificate remains valid through the original purchase period. But even with a clearer portal, certificates limited to 45–200 days still require reliable automation.
At this point, certificate management is more than knowing an expiry date. You need an inventory of where each certificate is installed, who owns it, whether renewal succeeded, and whether the replacement was actually activated. A provider with a good interface helps, but it does not replace an automated lifecycle process.
The most practical answer is to stop buying manually renewed certificates wherever possible. Let’s Encrypt or another ACME provider can issue certificates automatically, with DNS validation when the services are not publicly reachable. An ACME client can then run a deployment script to install the certificate on the firewalls.
For Windows, tools such as simple-acme can handle issuance, while Linux systems commonly use Certbot or similar clients. The hard part is the deployment step, especially for older appliances that do not support ACME directly.
WatchGuard does not need to speak ACME itself. A separate system can obtain the certificate and then upload or transfer it through the device’s available management method. Test that process carefully before deploying it across the whole fleet.
The first bulk issuance is where rate limits are most likely to hurt. Once renewals are distributed across the calendar, the normal renewal volume is usually much easier to manage.