Tutorial: How to Replace 1024-bit VPN Certificates for Access Server⁠

Overview⁠

This tutorial explains how to replace insecure 1024-bit VPN certificates with stronger ones for Access Server. You may encounter a warning message about legacy 1024-bit CA certificates, which are no longer considered secure. This guide will help you create a new CA certificate, migrate your VPN clients, and remove old certificates in a way that minimizes disruption to your users.

Sign in to your Admin Web UI.
Click Certificate Management.
- The Web Server Certificate tab displays.
Click the VPN Server Certificate Authority tab.
Click New CA Certificate.
- The New CA certificate modal displays.
Enter a Common name (optional) and select the Signing algorithm.
Click Add new CA and Restart.
- After Access Server restarts, the new CA displays in the list of Certificate Authority certificates and is labeled the Current CA.

Option 1: Import a new profile in OpenVPN Connect⁠

Open OpenVPN Connect.
Select the Add icon.
Enter your Access Server's URL.
Enter your username and password.
Select Import.

Option 2: Download a profile from the Client Web UI⁠

Sign in to the Client Web UI (your server's IP or hostname without /admin).
Download a connection profile.
Open OpenVPN Connect.
Select the Add icon, then File.
Drag and drop the .ovpn profile or browse for it on your device.

Option 3: Download pre-configured OpenVPN Connect from the Client Web UI⁠

Sign in to the Client Web UI.
Download OpenVPN Connect for your specific platform.

Sign in to the Admin Web UI.
Click Certificate Management.
- The Web Server Certificate tab displays.
Click the VPN Server Certificate Authority tab.
Locate the old CA and click on its name.
The VPN Client Certificates tab displays with the filter "Signing CA is [old CA name]". This displays profiles attached to the old CA.
Review the Last Used dates to ensure users no longer use old profiles.
- If all users have migrated, you can safely delete the old CA.
Click the VPN Server Certificate Authority tab.
Click the Delete icon for the old CA certificate.
Review the actions taken to delete the certificate, accept, and then click Delete CA and restart.
- Access Server restarts, and the old CA certificate is deleted.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: How to Replace 1024-bit VPN Certificates for Access Server⁠

Overview⁠

Was this information helpful?