Help Center> Virtual Private Network> User Guide> Enterprise Edition S2C VPN> Enterprise Edition VPN Gateway Management> Replacing Certificates of a VPN Gateway
Updated on 2024-06-27 GMT+08:00
View PDF

Replacing Certificates of a VPN Gateway

Scenario

When certificates of a VPN gateway of the GM specification expire or become invalid, you need to replace the certificates.

After certificates of a VPN gateway are replaced, the customer gateway must use the corresponding new CA certificate to renegotiate with the VPN gateway. Otherwise, VPN connections will be disconnected.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner and select the desired region and project.
  3. Click in the upper left corner, select a region, and choose Network > Virtual Private Network.
  4. In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Gateways.
  5. On the VPN Gateways page, locate a VPN gateway of the GM specification, and choose More > View/Upload Certificate in the Operation column.
  6. Click Replace and set parameters as prompted.
    Table 1 describes the parameters for replacing certificates of a VPN gateway.
    Table 1 Parameters for replacing certificates of a VPN gateway

    Parameter

    Description

    Example Value

    Certificate Name

    This parameter cannot be modified.

    The value must be the same as the original certificate name.

    New Signature Certificate

    Certificate used for signature authentication to ensure data validity and non-repudiation.

    Open the PEM signature certificate file (with the extension .pem) as a text file, and copy the content in the file to this text box.

    Enter both a signature certificate and its issuing CA certificate.

    -----BEGIN CERTIFICATE-----

    Signature certificate

    -----END CERTIFICATE-----

    -----BEGIN CERTIFICATE-----

    CA certificate

    -----END CERTIFICATE-----

    New Signature Private Key

    Private key used to decrypt the data that is encrypted by a signature certificate.

    Open the signature private key file (with the extension .key) as a text file, and copy the private key to this text box.

    -----BEGIN EC PRIVATE KEY-----

    Signature private key

    -----END EC PRIVATE KEY-----

    New Encryption Certificate

    Certificate used to encrypt data transmitted over VPN connections to ensure data confidentiality and integrity. The CA that issues the encryption certificate must be the same as the CA that issues the signature certificate.

    Open the PEM encryption certificate file (with the extension .pem) as a text file, and copy the content in the file to this text box.

    -----BEGIN CERTIFICATE-----

    Encryption certificate

    -----END CERTIFICATE-----

    New Encryption Private Key

    Private key used to decrypt the data that is encrypted by an encryption certificate.

    Open the encryption private key file (with the extension .key) as a text file, and copy the private key to this text box.

    -----BEGIN EC PRIVATE KEY-----

    Encryption private key

    -----END EC PRIVATE KEY-----
  7. Select "I have read and understand the preceding risk, and would like to replace the certificates anyway." and click OK.