IP Phones using Certificate based Authentication

[PaulPonzeka]

We are using Cisco Call Manager 11.5 and have recently configured IP Phones to connect to the ASA VPN using certificate based authentication.  We configurd CAPF, took the CA from CAPF and imported it on the ASA.  We can connect remotely using certificate based authentication with no issue.  My question comes around a couple of things:

1.  What is the lifetime of that certificate on the phone?  Do they get renewed periodically over the VPN?

2.  How would i disable a users phone from connecting to the VPN.  Say John Smith is using certificate based authentication, I can delete his phone from call manager and he wont be able to register anymore, but he would still be able to connect to VPN.  Is there anyway to prevent that? 

[Ayodeji Okanlawon]

The life time of any certificate is based on it's expiry date. Each root, intermediary and client certificate have expiry dates. The certs remain valid until that time. 

Uses connecting via phone vpn are completely separate from users login to vpn on their desktops. Deleting a phone won't stop a user using the enterpise VPN