Change hostname for Cisco router when it has a VPN tunnel with digital certificate

[wim_depauw]

Hi,

I would like to change the hostname for a Cisco router which has a VPN tunnel to a Central ASR 1002. THis tunnel is made with digital certificates so I will need to change the certificate also.

This is a slight problem since the CA server is only reachable through the VPN tunnel ....

Will the tunnel stay up if I delete the currenct public/private and certificate ? In my assumption it should stay up because it will only check on regular intervals .

Can somebody confirm this ?

gr

wim

[Yudong Wu]

I think you can create a new trustpoint and use it to get the new certificate without deleting the existing one. The new certificate can use the same rsa key pair as well. After you get the new certificate, you can then change the VPN related configuration to point to the new trustpoint.