How to Configure a Let’s Encrypt Certificate on Zyxel USG FLEX H Series Firewall

Zyxel USG FLEX H Series firewalls can use Let’s Encrypt to obtain trusted SSL/TLS certificates automatically through the ACME (Automatic Certificate Management Environment) protocol.

Instead of manually generating, importing, and replacing certificates, the firewall can request a certificate from Let’s Encrypt and automatically renew it before expiration.

Let’s Encrypt certificates are valid for 90 days. By default, the firewall renews the certificate 30 days before expiration, and the renewal period can be configured up to 60 days before expiration.

The firewall supports two methods for validating domain ownership:

• HTTP-01 – validation through an HTTP connection to the firewall.
• DNS-01 – validation through a DNS TXT record.

This article explains how to configure and verify a Let’s Encrypt certificate using either method.

Note: The configuration of the DNS provider itself, including creating a Cloudflare API token, is outside the scope of this guide. If you are interested in Cloudflare, please follow the link to the article: How to Configure Cloudflare DDNS on Zyxel H Series Firewalls

Requirements

Before requesting a Let’s Encrypt certificate, make sure that:

• You have a publicly resolvable Fully Qualified Domain Name (FQDN).
• The FQDN is under your control.
• The firewall has Internet access.
• A valid and reachable email address is available.
• The required conditions for either HTTP-01 or DNS-01 validation are met.

The firewall acts as the ACME client and automatically handles certificate issuance and renewal.

HTTP-01 or DNS-01: Which Method Should You Use?

Both methods verify that you control the domain for which the certificate is being requested, but they work differently.

With HTTP-01, Let’s Encrypt connects to the firewall through TCP port 80 and requests a temporary ACME validation URL.

With DNS-01, the firewall creates a temporary _acme-challenge TXT record and Let’s Encrypt verifies this record through public DNS.

Step 1 – Configure the Certificate Settings

Log in to the firewall Web GUI and navigate to:

System > Certificate > Let’s Encrypt Certificate

Click Add and configure the following settings as shown in the screenshot:

• Domain Name: Enter the FQDN for which the certificate will be issued. The FQDN must be publicly resolvable.
  Example: H500.zylab.uk
• Email: Enter a valid and reachable email address.
• Renew Before Expiry: Specify when the firewall should start renewing the certificate. The default is 30 days and can be configured from 1 to 60 days before expiration.
• Subject Alternative Name (SAN): Add additional FQDNs that should be included in the same certificate. Up to five SAN entries are supported. Wildcard FQDNs are not supported. Changing SAN entries after issuance requires the certificate to be reissued.
• Under Challenge Configuration, select the validation method that matches your environment.
• You can use either:
• HTTP-01
• DNS-01

Option 1 – Request a Certificate Using HTTP-01

HTTP-01 validates domain ownership by allowing Let’s Encrypt to connect to the firewall over TCP port 80.

• Create a Public DNS A Record

Before starting the validation, the certificate FQDN must be publicly resolvable.

Create an A record at your DNS provider that points the FQDN to the firewall's public WAN IPv4 address.

Important: If the A record is missing, Let’s Encrypt cannot resolve the firewall FQDN and HTTP-01 validation fails with an NXDOMAIN error.

Configure HTTP-01

Navigate to:

System > Certificate > Let’s Encrypt Certificate

Configure the certificate settings and select:

Challenge Type: HTTP-01
Renew Time: 03:00 (recommended)

HTTP-01 requires the firewall to be reachable from the Internet through TCP port 80.

Start Validation and Certificate Issuance

Click Apply.

The firewall displays the Certificate Issuance Options.

For immediate validation and certificate issuance, select:

Validate and Issue Now and click Continue.

During HTTP-01 validation, the firewall temporarily redirects WAN port 80 traffic for approximately 2–3 minutes, up to 5 minutes. Required firewall rules are created and removed automatically.

If port 80 is normally forwarded to an internal server, that service may be temporarily unavailable. For this reason, perform HTTP-01 validation during off-peak hours when possible.

Verify HTTPS Access with the Let’s Encrypt Certificate

After the certificate has been successfully issued, it can be assigned to the firewall Web GUI.

Navigate to:

System > Settings > Administration Settings

Under HTTPS > Server Certificate, select the issued certificate:

h500.zylab.uk

Click Apply.

Option 2 – Request a Certificate Using DNS-01

DNS-01 validates domain ownership by creating a temporary DNS TXT record. Unlike HTTP-01, this method does not require inbound access to the firewall on TCP port 80.

Configure DNS-01 Validation

Navigate to:

System > Certificate > Let’s Encrypt Certificate

Configure the certificate settings, then under Challenge Configuration select:

DNS-01 (Cloudflare)

Enter:

• Cloudflare Zone ID
• Cloudflare API Token

The firewall uses these credentials to automatically create and remove the TXT record required for ACME validation.

Note: In this example, Cloudflare was already configured and the required Zone ID and API Token were available. For instructions on configuring Cloudflare, refer to the dedicated Cloudflare configuration article.

Test DNS-01 Validation

After saving the configuration, select the certificate and click Test.

The firewall performs a Dry Run – Validation Test.

During DNS-01 validation, the firewall:

1. requests the ACME challenge;
2. creates the required _acme-challenge TXT record through the Cloudflare API;
3. waits for Let’s Encrypt to verify the DNS record;
4. removes the temporary TXT record after validation.

A successful test displays messages similar to:

Check authorization success
Cloudflare API responded: Record delete successfully
dryrun verified successfully
Script finished. Result: SUCCESS