PKI cerificate server in DMVPN network:EEM script

[lap]

Hi all,

Before to jump into the subject I have two questions:

1) When the root certificate expire is it possibe to renew it automatically?

2) When a Spoke certificate is renew will the spoke save the new certificate in NVRAM?

----------------------------------------------------------------------------------------------------------------------------------

What I am looking for is a solution that could send a log/mail to our customer 2 days (for example) before the certificate expire on the SPOKE/ROOT CA. It could be a TCL script or EEM script.

Any ideas folks on how it could be made best?

Thanks in advance.

Regards,

Laurent

[Marcin Latosiewicz · Accepted solution]

Laurent,

If you enrolled via SCEP, as far as I remember, timers for both CA and indetitiy cert rollover are kept (you can check in "show crypto pki timer").

We do not not automatically stope the certificate to running configuration, you have to perform a manual "wri" when enrollment (or re-enrollment is done), this is to be able to recover if things do not go your way.

I have never created such a script but it will heavily depend on your current configuration/deployment scenario.

Marcin

[lap]

Hi Marcin,

Sorry for the late reply. Thanks for your help.

/Laurent