Hi Gavin,
a. Yes you can have two ID certs, as long as you install the new one on a different Trustpoint.
b. It actually depends if both are the same exact certificate, then most likely the ASA will use the oldest one.
Is this for AnyConnect certificate authentication? If so, the only certificate that the ASA needs to have is the Root from the same CA as the one the clients got the certificate from.
In case the ID is about to expire on the client side, then you need to renew it, if the Root certificate is about to expire on the ASA, then you need to renew it.
For this to work you need:
1- The Root certificate from the CA installed on the ASA.
2- Each client must have an ID cert from the same CA.
3- Define certificate authentication under the webvpn attributes.
Please check this out:
AnyConnect Certificate Based Authentication
Let me know if you have any further questions.
Portu.
Please rate any helpful posts.