topic Multiple Certs w/ Overlapping Expirations in General Topics

Multiple Certs w/ Overlapping Expirations

tseger — Wed, 10 Nov 2021 23:15:04 GMT

We have a certificate expiring and we just uploaded the new certificate to take its place. To avoid downtime, we haven't revoked the soon to expire cert and have the other one imported already. They are both in valid state.

When the first one expires, will the 2nd (new) cert "take its place" automatically? Or will there need to be some manual intervention at that time?

Re: Multiple Certs w/ Overlapping Expirations

BPry — Thu, 11 Nov 2021 04:36:26 GMT

@tseger,

This really depends on what you're using the certificate for. The certificate itself is a completely different object, so if your using it in a a certificate-profile it'll need to be included, or if your using it in a ssl-tls-service-profile it'll need to be updated.

If your just using it to establish certificate trust (for example like a root CA) then importing it and setting it as a trusted-root-ca then the import is really all you need.

Re: Multiple Certs w/ Overlapping Expirations

tseger — Fri, 12 Nov 2021 22:12:31 GMT

Thank you for the reply!

Researching this, the existing is used in a certificate profile, so I would need to switch it over.

Is there a way to do so with no downtime? As in, if I were to just change the Certificate value in the existing Certificate Management > SSL/TLS Profile to the new certificate object's name, would that be in immediate change after commiting it with no downtime/breaking live GlobalProtect users' sessions?

Re: Multiple Certs w/ Overlapping Expirations

BPry — Mon, 15 Nov 2021 04:13:12 GMT

@tseger,

I always do these kind of changes off hours just in case, but they haven't ever caused any disruption in the past for me as long as everything is good with the new certificate. The active clients always handle it without any issue at all.