Renew of Self Signed SSL Forward Trust Certificate without Root CA

f.kuecuek — Wed, 13 Aug 2025 10:13:25 GMT

Hello,

I have a self-signed (self-generated) certificate without a Root CA on a firewall, which is used for SSL Forward Proxy to decrypt traffic.

The certificate is valid for 10 day and has been imported on client machines as a trusted root CA.

The question is that : If I renew this certificate on the firewall, will I need to re-import it on the clients, or can they continue to use the old/expired trusted CA?

In lab tests, the key pair on the firewall did not change after renewal, and clients still trusted the old certificate.

Has anyone encountered a similar scenario or can confirm this behavior?

Thank you.

Re: Renew of Self Signed SSL Forward Trust Certificate without Root CA

mshekh — Thu, 14 Aug 2025 16:56:17 GMT

Hi @f.kuecuek ,

Greetings!

Yes, you will need to re-import new certificate on the clients with updated expiry date.

topic Re: Renew of Self Signed SSL Forward Trust Certificate without Root CA in Next-Generation Firewall Discussions

Renew of Self Signed SSL Forward Trust Certificate without Root CA

Re: Renew of Self Signed SSL Forward Trust Certificate without Root CA