ACS Distributed Deployment CA Cert Renewal

[jofische]

When renewing CA certs in a distributed deployment are there any gotchas to be aware of?  We would like to renew certs on individual nodes during different change windows.  I don’t think this should be a problem as long as the certs are trusted but asking to be certain.

Thanks!

[kthiruve · Accepted solution]

In ACS you have a primary and multiple secondary, so when renewing CA certs make sure you have the CA certificate installed in all the secondary and Primary first.

Renew the server certificate in the secondary first and then primary at the end. Use a CA signed certificate as a best practice.

If using self-signed, same logic applies.

-Krishnan