In this section:
This topic explains how to renew the PKI certificates. The PKI certificates are signed for a defined period of time. Certificates are subject to expiration. When a certificate is about to expire, a new certificate with a prolonged validity must be created and the existing certificate in the SBC needs to be replaced.
The certificate replacement procedure may affect the service since you will need to replace the old certificate with the new one. New sessions are not established during the certificate replacement. The stable sessions are maintained.
Import the new local certificate to SBC and enable it.
set system security pki certificate <NEW PKI Certificate Name > fileName <p12 filename> type local passPhrase <passPhrase> state enabled
Schedule a maintenance window to replace the old certificate with the new certificate in all TLS profiles that use the old/expired certificate and delete the old certificate.
set profiles security tlsProfile <Existing TLS Profile Name> serverCertName/clientCertName <NEW PKI Certificate Name> set system security pki certificate < OLD PKI Certificate Name> state disable delete system security pki certificate <OLD PKI Certificate Name> commit
Import the new remote certificate to the SBC and enable it.
set system security pki certificate <PKI Certificate Name - 2> fileName <der filename> type remote state enabled
If any of the SBC local and the local-internal certificates are signed by a CA whose certificate is going to expire and is installed as a “remote” certificate in the SBC, the user needs to renew the corresponding local and local-internal certificates and sign by the new remote OR root CA certificate.