About the VPN Authentication Page

Tasks You Can Perform

• View information about the existing certificates. See Table 2.

• Change the method of renewing PKI certificates for a tenant. See Changing the Method of Renewing PKI Certificates for a Tenant.

• Change the method of renewing PKI certificates for sites. See Changing the Method of Renewing PKI Certificates for Sites .

• Update the CRL URL of certificates. See Updating the CRL URL of Certificates.

• Change the CA Server URL and Password. See Change the CA Server URL and Password.

• Manually renew certificates for sites. See Manually Renewing Certificates for Sites.

Changing the Method of Renewing PKI Certificates for a Tenant

In Customer Portal, the method of renewing PKI certificates for a tenant is configured when the tenant is onboarded.

You, as a tenant administrator, can change the method of renewing PKI certificates for an onboarded tenant from the VPN Authentication page.

1. On the VPN Authentication page, click the Change link.

   The Tenant Certificate Renewal Method page appears.

   Note

   Certificates will not be renewed for sites that are down or do not have connectivity to CSO at the current time.

2. By default, the Auto Renew Certificate toggle button is disabled. Click the toggle button to enable the automatic renewal of certificates.

   If you do not enable the automatic renewal of certificates, they must be manually renewed. See Manually Renewing Certificates for Sites for more information.

3. If you enabled the automatic renewal of certificates, in the Renew Before Expiry field, select the period before the expiry date on which the certificates should be automatically renewed:

   • 3 Days

   • 1 Week

   • 2 Weeks (default)

   • 1 Month

4. Click OK to save your changes.

   The Confirm Renew Certificate page appears.

5. Click Yes to confirm your changes.

   A job is created to check the expiration date of certificates for all sites of the tenant. If a certificate is nearing the configured expiry date, the certificate is automatically renewed.

   You are returned to the VPN Authentication page where a confirmation message appears.

Changing the Method of Renewing PKI Certificates for Sites

1. On the VPN Authentication page, select one or more sites from the list of available sites and click Change Renewal Method.

   A drop-down list appears.

2. From the list, choose the renewal method (Set Auto Renew or Set Manual Renew).

   The Edit Certificate Renew Method page appears.

3. Click Yes to change the renewal method.

   • If you set the renewal method as automatic, a job is created to check the expiration date of certificates for the selected sites. If a certificate is nearing the configured expiry date, the certificate is automatically renewed.

   • If you set the renewal method as manual, certificates must be manually renewed. See Manually Renewing Certificates for Sites for more information.

   You are returned to the VPN Authentication page, where a confirmation message appears.

Updating the CRL URL of Certificates

CSO obtains the latest list of certificates revoked by the Certificate Authority (CA), from the CRL (Certificate Revocation List) server, when you update the CRL URL of certificates.

1. On the VPN Authentication page, click Update CRL URL.

   The Edit Tenant Certificate CRL page appears.

2. In the CRL Server field, update the CRL URL.
3. Click OK.

   A job is created to download the latest CRL.

   You are returned to the VPN Authentication page, where a confirmation message appears.

Change the CA Server URL and Password

You, as an SP administrator or OpCo administrator, specify the CA Server URL and password on the Administration Portal during tenant onboarding.

1. On the VPN Authentication page, click the Change link.

   The Tenant Certificate Renewal Method page appears.

2. Specify the updated CA Server URL and Password in the CA Server URL and Password fields, respectively.
3. Click OK to save your changes.

   The Confirm Renew Certificate page appears.

4. Click Yes to confirm your changes.

   A confirmation message appears on the VPN Authentication page and the CA server URL and password are updated for all sites of the tenant.

Manually Renewing Certificates for Sites

1. On the VPN Authentication page, select one or more sites from the list of available sites and click Renew Certificate.

   The Confirm Renew Certificate page appears.

2. Click Yes to manually renew the certificates.

   A certificate renewal job is triggered and a confirmation message appears on the VPN Authentication page.

Field Descriptions

Table 1 provides information about tenant-level settings for a PKI certificate, on the VPN Authentication page.

Table 2 displays details of the certificates on the VPN Authentication page.