Replacing a WAF certificate involves two separate checks: preparing the correct certificate material and confirming that the public HTTPS endpoint serves it afterward. Copying new files into a directory does not, by itself, prove that a running service has loaded them.

For SafeLine, the supplied official documentation explains installation and HTTPS application setup, but it does not specify certificate file locations, a certificate replacement workflow, or a refresh command. This guide therefore provides a numbered preparation and verification checklist. Use deployment-specific instructions to perform the actual replacement; do not infer a reload procedure from the installation commands.

1. Identify the HTTPS endpoint you intend to change

Start with the exact hostname and port that users visit. Record whether the change concerns a protected application's HTTPS endpoint or the administrative console.

This distinction matters because the installation guide identifies the console at https://<safeline-ip>:9443/, while application setup separately defines a domain, listening port, and upstream address. The application guide also instructs administrators to select the SSL option for HTTPS applications. These are distinct configuration contexts. Sources: SafeLine installation guide, application configuration guide.

Write down the intended endpoint before touching certificate material. Otherwise, it is possible to validate the console while leaving the customer-facing certificate unchanged.

2. Map where TLS terminates

Sketch the request path from the client to the application. Include any components present in your own deployment, and identify which component presents the certificate that needs renewal.

SafeLine's application documentation describes it as an nginx-based HTTP/HTTPS reverse proxy that receives website traffic and forwards acceptable traffic to the upstream application. That establishes its role in the request path, but it does not document how certificate files are managed. Source: SafeLine application configuration guide.

Treat the public endpoint and any upstream HTTPS connection as separate verification targets. A certificate renewed at the origin will not necessarily change the certificate a visitor sees at an earlier TLS termination point.

3. Validate the replacement material before deployment

Prepare a certificate inventory containing the hostname, expiration date, issuer, and certificate fingerprint. Check that the replacement certificate covers every required hostname and that its validity period is appropriate for the change window.

Confirm that the private key matches the certificate and that the necessary intermediate certificates are available. Protect the private key during storage and transfer; do not include it in tickets, screenshots, or shared troubleshooting notes.

These are general TLS preparation checks. The supplied SafeLine sources do not establish accepted certificate formats, chain ordering, encrypted-key support, or upload requirements. Verify those details for your installed version before preparing the final deployment files.

4. Establish the supported replacement and refresh procedure

Before making changes, obtain instructions that explicitly cover your deployed version and the endpoint identified in step 1. The procedure should answer three questions: where certificate material is managed, how the replacement becomes active, and how to restore the previous configuration.

The supplied installation guide includes docker compose up -d for launching SafeLine. It does not describe that command as a certificate refresh mechanism. Do not assume that rerunning a startup command, restarting a container, or editing an inferred nginx path is the supported renewal workflow. Source: SafeLine installation guide.

If these operational details remain unknown, complete the inventory and validation work first, then resolve the procedure before changing production.

5. Prepare rollback and apply the documented change

Retain the currently working certificate material and the configuration needed to restore it, subject to your key-handling policy. Record the existing public certificate fingerprint so that you can distinguish a successful replacement from a rollback.

Choose a change window appropriate to the procedure's documented service impact. Do not promise uninterrupted service unless the replacement mechanism explicitly supports it.

Apply the replacement and activation steps from the applicable instructions. Record what changed and when. Avoid combining certificate renewal with unrelated routing or application changes, which makes failures harder to diagnose.

6. Verify the certificate from the client side

Open a fresh connection to the intended hostname and port. Check the certificate actually presented: hostname coverage, expiration, issuer, fingerprint, and chain trust. A successful page load alone is insufficient because the endpoint could still be serving the previous certificate.

Confirm that normal application requests succeed. If your deployment has multiple serving endpoints, verify each relevant path rather than assuming one successful connection represents all traffic.

SafeLine's application setup guide directs administrators to resolve the application's domain to the SafeLine server's IP address. Check that your verification reaches the intended destination, especially if DNS or routing changed during maintenance. Source: SafeLine application configuration guide.

7. Close the change with evidence

Record the observed fingerprint, expiration date, verification time, and application health result. Keep rollback material only as long as your operational policy requires, with private keys protected throughout.

The completion criterion is observable: fresh client connections receive the intended certificate and the application works through its expected route.

Does the supplied documentation provide a SafeLine certificate refresh command?

No. It documents installation and application configuration, but does not specify a certificate replacement or refresh command. This guide deliberately leaves that execution step dependent on applicable instructions.

Is replacing certificate files enough?

Not necessarily. A service may require an activation step before it serves changed certificate material. Verify the procedure for the component terminating TLS, then inspect a fresh client connection.

Should I test the administrative console or the application?

Test the endpoint whose certificate you changed. If both are in scope, validate both separately. The supplied documentation describes the console URL and application listening settings separately.

What should I check if the old certificate still appears?

Recheck the destination address, hostname, port, and TLS termination point. Confirm that the prescribed activation step completed and that each relevant serving endpoint received the change. Compare fingerprints rather than relying only on certificate names.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.