Expiration of certificate CA (lifetime) and security

Hello

I'm deploying a VPN solution based on public key infrastructure. I am concerned about the security of having a structure based on the PKI with certificates are valid for too long. At the same time, I want to be able to have a router that is preconfigured for the quick replacement of an existing router (when it fails og needs an upgrade). This can lead to problems of validity certificate if the stock routers certificate expires. To mitigate this potential security issue, I thought to have two parallel PKI configurations. Validity (primary production) CA that has a certificate 2 years and a certification authority (supply) which has a validity of 10 years certificate.

I have a few questions about this facility and ICP in general:

  1. I know that I can re-register routers automatically for a new certificate when the existing one expires. But what of the CA? I need to authenticate cases public certificate to trust my peers after the expiry of the certification authority. Can I configure the router to automatically authenticate previously authenticated CA? I use Microsoft Windows Server 2008 for servers in CA.
  2. How can I safely re-register a VPN router connected to another certification authority without losing the session? (See my attachment)
  3. A router can cause two trustpoints and how it differ between them (choose the right pair) when authenticating a peer?

Thank you

/ ENTOMOLOGIST

ENTOMOLOGIST,

In regard to point 1) registered PEIE hosts should be able to do it automatically...

It's going to generate a new certificate of flipping (it won't be visible as shadows) after that the router should try to re-register with the CA and get their certificate signed by the new CA shadow (depending on several factors).

Or it is at least my memory of 1.5 years back when I was being implemented something similar.

(2) I don't belive trustpoint removing will cause a phase shift 2 IPsec - but once again if I'm in the point 1) nothing is needed for this.

(3) If two valid trustpoints, the two payloads CERT_REQ will be sent in MM3 or MM4 for IKEv1 (or in the second message IKE_SA_INIT and IKE_AUTH 1 msg in the IKEv2 case).

HTH,

Marcin

Tags: Cisco Security

Similar Questions

Maybe you are looking for

  • How can I remove a user name to appear on the list because he's wrong my password added to it.

    I want my user name appears when I start typing, so I don't have to type it every time. But I typed in my password error before that the username has been entered, and now a username with my password appears in the list when I enter the first letter.

  • Command PID made al control of DC motors

    Hola a todos Alguien me could asesorar con el uso del PID toolkit there that manera lo puedo more al control of 2 DC motors, con doble cuadratura encoders

  • HP ENVY 17-j053ea hard drive locations

    Hi I am looking to buy the HP ENVY 17-j053ea, far specifications correspond to my needs, but there is just one thing I need to know. Does the laptop afore mentioned have a secondary HARD drive location? I have an old DV9000 series that has two slots

  • GTX 770 4 GB impossible to select 144 Hz on dell S2716DG.

    Hi all Yesterday, I bought a new monitor, dell S2716DG. My problem is that I can't select option 144 Hz even at lowest ressolution. MAX I can get is 120 Hz. And my question is this problem aside GPU or monitor? I use DP connetion added to my dell. It

  • PSI triple with Cisco IOS XR

    Hey the Cisco Experts Greeting I've lost my way with config RPL, calling all of you to help me how config RPL looks for the scenario below, 2 X ASR 9006 political 0utbound=============== 1. LIKE 52 X accepts the local routes of 3 providors, as well a