Tutorial: How to Manually Regenerate Self-signed Certificates
Overview
When Access Server isn’t provided with SSL web certificates, it uses its self-signed certificates and regenerates those when certain conditions are met. If these files have been tampered with, resetting them with the instructions found here is possible. This is to meet today’s stricter security requirements for self-signed certificates. EKU is one of those requirements, and since older versions of Access Server generated self-signed certificates without EKU, they are regenerated when you upgrade to Access Server 2.9 and newer.
If all of the below conditions are met, the Access Server enables its internal logic for self-signed certificate management:
These configuration keys—cs.cert, cs.priv_key, cs.ca_bundle, and cs.ca_key—do not store certificates and keys in-line.
The file /usr/local/openvpn_as/etc/web-ssl/ca.crt has a CN that contains: “OpenVPN Web CA”.
The file /usr/local/openvpn_as/etc/web-ssl/ca.key exists.
In addition to the above, if any of the triggers below match, Access Server regenerates the certificates:
The certificate expiration date is less than 180 days away.
The certificate does not contain EKU parameters.
The certificate CN does not match the hostname configured in Access Server.
To install valid SSL web certificates and replace the self-signed certificates, refer to this tutorial: