I currently have a working VPN as follows:
PIX 515e configured as a remote access IPSec VPN using certificates for authentication.
Cisco PIX Security Appliance Software Version 7.1(2)
Device Manager Version 5.1(2)
The clients are linux and use:
Cisco Systems VPN Client Version 4.8.00 (0490)
Copyright (C) 1998-2005 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Linux
Everything is working just fine, except the CA certificate is due to expire soon and there are hundreds of clients that will need to be updated along with the PIX side certificates. The CA server is Windows 2003. How can I go about renewing the CA while keeping the existing clients connected until they can be updated?
I found this: LINK …and it talks about renewing the CA while keeping the same key pair. This solution doesn't create a replacement CA, it creates an additional certificate to be used in conjunction. I cannot find any documentation on how to implement this in the PIX. Do I need to create an additional trust point, tunnel group, etc?
I have cloned the CA server into an isolated virtual machine so that I can keep the production server safe. I also have a development PIX with a clone of the production config and some clients connected to it. This should allow me to test things out safely.
Any help is very greatly appreciated!
