ACE SSL certificate renewal

[rjuchta]

Hello,

Is it possible to renew SSL certificate on ACE without SSL offloading service interruption? Can i just swap certificate files, and expect ACE to pick up new certificates without removing ssl proxy-server and reapplying it to policy-map?

thanks,

WM

[ajayku2]

I dont think it is possible. You should disable SSL and then reenable it after putting  the new cert.

[sivaksiv · Accepted solution]

Hi,

I guess the new ACE software supports graceful cert renewal, wherein the new conns 
will take the new cert while the existing conns will still be served from the old cert.

-
Siva

[ajayku2 · Accepted solution]

I agree with Siva.

You can follow:

http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/ssl/guide/certkeys.html#wp1061898

Following is from the above link:

Upgrading an SSL Certificate

To upgrade an SSL certificate without disrupting active SSL sessions or pending SSL sessions, use the following steps:

---

Step 1 Import the new SSL certificate using the crypto import command in Exec mode and save it with a new name. See the "Importing Certificate and Key Pair Files" section. For example, to import a certificate from an SFTP server, enter the following command:

host1/Admin# crypto import non-exportable sftp 1.1.1.1 JOESMITH 
/USR/CERTS/MY_CERT.PEM MY_NEW_CERT.PEM

Password: ********

Passive mode on.

Hash mark printing on (1024 bytes/hash mark).

#

Successfully imported file from remote server.

host1/Admin#

Step 2 While the SSL proxy service is actively processing flows, change the certificate file association within the SSL proxy service to the new certificate by using the cert command in SSL proxy configuration mode. See the "Specifying the Certificate" section in Chapter 3, Configuring SSL Termination.

For example, to associate the certificate in the MY_NEW_CERT.PEM certificate file with the PSERVICE_SERVER SSL proxy service, enter the following commands:

host1/Admin(config)# ssl-proxy service PSERVICE_SERVER

host1/Admin(config-ssl-proxy)# cert MY_NEW_CERT.PEM

[rjuchta]

Many thanks guys, we'll think about upgrading our ACE's.

WM