ExpressWay-E certificates

[Tieken Maas]

Hello everyone,

I'm a bit puzzled as to the following point. Initially, we deployed Expressway-C and -E nodes and used "grey" certificates for the traversal zone. We installed a Windows 2008 based CA, with a self-singned root certificate, and server certificates for both -C and -E nodes were issued using this CA. The traversal zone is ok.

Now the customer would like to use a public "white" certificate for -E node so that WebRTC clients don't receive a warning about a non-reliable certificate. The question is whether we can upload one more server certificate (signed by a public CA like Let's Encrypt) to -E node or not? Won't it disrupt the traversal zone?

ExpressWay version is 8.11.4

Regards,

Tieken

[Jaime Valencia]

No, you can only have one server certificate on the expressways, you'll need to generate a new CSR from EXP-E or your own from openssl (or any other tool you like), have it signed, and upload it.

If I recall correctly, it does call for a reboot so services can start using the new certificate.

If you keep the trust chain and the same CN/SAN there should be no problem with your traversal zone.