DO NOT SHARE THESE DOCS WITH CUSTOMERS!

This is an LA release that will only be provided to a select number of PLM-sanctioned customers (PDFs only). Contact PLM for details.


In this section:

Introduction

This topic explains how to renew the PKI certificates. The PKI certificates are signed for a defined period of time. Certificates are subject to expiration. When a certificate is about to expire, a new certificate with a prolonged validity must be created and the existing certificate in the SBC needs to be replaced.

Procedure

Note

The certificate replacement procedure may affect the service since you will need to replace the old certificate with the new one. New sessions are not established during the certificate replacement. The stable sessions are maintained.

Note

Renewing the certificate (i.e., replacing the clientCertName and/or serverCertName in a tlsProfile) takes effect immediately. The SBC will use the new certificate for new TLS connections; however, the existing active TLS sessions will still use the old certificate.

A typical example of the SBC using the old certificate after renewing the certificate is a TLS connection containing an ipPeer with pathCheck enabled. The periodic SIP OPTIONS pings generated by the pathcheck task serve as a keep-alive maintain the active TLS session between the SBC and the remote peer. The SBC performs regular checks for expired certificates using the certExpiryCheck feature (Certificate Expiry Check - CLI). Once the certificate validity reaches its expiry date, the certExpiryCheck feature will detect it and tear down all TLS connections that use the expired certificate. The SBC then initiates a new TLS connection and uses the renewed certificate at the point of sending a new SIP message (including a pathcheck SIP OPTIONS ping) towards the peer.

In order to manually force the SBC to use the new certificate for TLS connections that are active at the point of the certificate renewal, you must disconnect and re-initiate the TLS connections. Currently, a manual node switchover (bouncing an ipInterface or bouncing the sipSigPort) are the only available means to forcibly disconnect the existing TLS sessions.

Local Certificates

  1. Generate the new local certificate by performing the steps used to generate the old certificate. Use the same Subject and SAN/CN details used in the old certificate and use the old certificate CSR file to generate the new certificate. To import the local certificates refer to PKI Security - CLI > Local-Internal Certificates.
  2. Sign the new local certificate by the same CA that was used to sign the old certificate with a prolonged validity.

  3. Import the new local certificate to SBC and enable it.

    set system security pki certificate <NEW PKI Certificate Name > fileName <p12 filename> type local passPhrase <passPhrase> state enabled
  4. Find all TLS profiles with the current local certificate.

  5. Schedule a maintenance window to replace the old certificate with the new certificate in all TLS profiles that use the old/expired certificate and delete the old certificate.

    set profiles security tlsProfile <Existing TLS Profile Name> serverCertName/clientCertName <NEW PKI Certificate Name>

set system security pki certificate < OLD PKI Certificate Name> state disable

delete system security pki certificate <OLD PKI Certificate Name>
commit

Local-Internal Certificates

  1. Generate the new local-internal certificate with the same procedure used to generate the old certificate. Use the same Subject and SAN/CN details used in the old certificate to generate a new CSR or use the old certificate CSR file to generate the new Local-Internal certificate. To create and configure a new Local-Internal Certificate, refer to Generating PKI Certificates.
  2. Sign the new Local-Internal certificate by the same CA that was used to sign the old certificate with a prolonged validity.
  3. Import the new Local-Internal certificate to the SBC and enable it.
  4. Find all TLS profiles where the currently used Local-Internal certificate, which is going to expire is assigned.
  5. Schedule a maintenance window to replace the old certificate with the new certificate in all TLS profiles and delete the old certificate.

Remote Certificates

  1. Generate the new remote certificate with the same procedure used to generate the old remote certificate.
  2. To import remote certificates, refer to PKI Security - CLI > Local-Internal Certificates.

Import the new remote certificate to the SBC and enable it.

% set system security pki certificate <certificate name> fileName <1-255 characters> type <local | local-internal | remote> state state <disabled | enabled>

Example:

set system security pki certificate COMPANY_CA filename company_ca.pem type remote state enabled
commit
Note

If any of the SBC local and the local-internal certificates are signed by a CA whose certificate is going to expire and is installed as a “remote” certificate in the SBC, the user needs to renew the corresponding local and local-internal certificates and sign by the new remote OR root CA certificate.