SD-Wan certificate issue.

[R Manjunatha]

Hi

I need to understand what will happen if the sd-wan certificate is expired. The communication between the edge device and the controllers will be interrupted.

regards,

[Torbjørn]

Which certificate is it that you are asking about? The root CA or the certificates used by specific controllers?

If it is the root certificate all control connections will drop and forwarding will continue as usual until the OMP graceful restart timer runs out or the ipsec rekeying timer runs out. You will experience the same issue as the one caused by the expired certificate in May: https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/220448-identify-vedge-certificate-expired-on-ma.html

[R Manjunatha]

Yes, I'm asking about root CA. 

[Torbjørn · Accepted solution]

If you know you are going to face this issue in production I would escalate this to ensure you have "all hands on deck" to replace the certificate ASAP. You can raise the IPsec rekey timer to 14 days and the graceful restart timer to 7 days to extend the time before you face dataplane issues. You should create a TAC case for this.

If the root CA expires your DTLS tunnels/control connections will drop.

[R Manjunatha]

Thanks, for the clarification.