Tutorial: How to Replace 1024-bit VPN Certificates for Access Server
This tutorial will help you replace outdated 1024-bit certificates with more secure ones, ensuring long-term compatibility and security for your VPN clients.
Overview
This tutorial explains how to replace insecure 1024-bit VPN certificates with stronger ones for Access Server. You may encounter a warning message about legacy 1024-bit CA certificates, which are no longer considered secure. This guide will help you create a new CA certificate, migrate your VPN clients, and remove old certificates in a way that minimizes disruption to your users.
An installed Access Server.
Console access and get root privileges.
A server configuration backup.
Understanding that changes will temporarily disconnect VPN clients.
Sign in to your Admin Web UI.
Click Certificate Management.
The Web Server Certificate tab displays.
Click the VPN Server Certificate Authority tab.
Click New CA Certificate.
The New CA certificate modal displays.
Enter a Common name (optional) and select the Signing algorithm.
Click Add new CA and Restart.
After Access Server restarts, the new CA displays in the list of Certificate Authority certificates and is labeled the Current CA.
Notice
Most VPN clients will continue using their old certificates until new profiles are downloaded. Below are several options for users to migrate.
Option 1: Import a new profile in OpenVPN Connect
Open OpenVPN Connect.
Click the Add icon.
Enter your Access Server's URL.
Enter your username and password.
Click Import.
Option 2: Download a profile from the Client Web UI
Sign in to the Client Web UI (your server's IP or hostname without
/admin).Download a connection profile.
Open OpenVPN Connect.
Click Add icon, then File.
Drag and drop the .ovpn profile or browse for it on your device.
Option 3: Download pre-configured OpenVPN Connect from the Client Web UI
Sign in to the Client Web UI.
Download OpenVPN Connect for your specific platform.
Notice
Once all users have migrated to new profiles, the warning message regarding the 1024-bit CA will disappear when the old CA is deleted. Before removing it, verify that all users have switched to the new CA.
Sign in to the Admin Web UI.
Click Certificate Management.
The Web Server Certificate tab displays.
Click the VPN Server Certificate Authority tab.
Locate the old CA and click on its name.
The VPN Client Certificates tab displays with the filter "Signing CA is [old CA name]". This displays profiles attached to the old CA.
Review the Last Used dates to ensure users no longer use old profiles.
If all users have migrated, you can safely delete the old CA.
Click the VPN Server Certificate Authority tab.
Click the Delete icon for the old CA certificate.
Review the actions taken to delete the certificate, accept, and then click Delete CA and restart.
Access Server restarts, and the old CA certificate is deleted.