ASA 5555 Certificate Renewal when VPN phones are not registered

[Teresa Primrose]

1. Can new certificates be installed before the original certificate expires and have dual certificates loaded?

2. It is impractical to ensure phones are connected during the certificate replacement process therefore if 1.can be performed, will IP VPN phones when theynext register pick up the replacement certificate.

[matthewik.lee]

Hi,

http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116162-trouble-anyconnect-vpn-phone-00.html#anc31

Renewal of the ASA SSL Certificate

If you have a functional AnyConnect VPN phone setup but your ASA SSL certificate is about to expire, you do not need to bring all IP phones to the Main Site in order to inject the new SSL certificates to the phone; you can add the new certificates while the VPN is connected.

Hope it helps. Matthew