> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CA Certificate Rotation of UserVPN

> Rotate the UserVPN CA certificate in the Aviatrix Controller with either a simple or a staged workflow to keep client and server certificates trusted.

## Overview

Aviatrix UserVPN uses a Certificate Authority (CA) to issue and manage the
client and server certificates required for secure VPN authentication. When the
Controller is first initialized, it creates a self-signed RSA CA with a 10-year
validity period.

Rotate this CA before it expires or whenever re-keying is required.

**CA rotation** replaces the existing CA certificate and private key with new
ones. Rotation includes re-keying, issuing a new CA certificate, and re-issuing
UserVPN client and server certificates under the new CA.

This guide describes two UserVPN certificate lifecycle workflows: **Simple
Rotation** and **Staged Rotation**.

## When to Rotate the CA

Rotate the CA when:

* The CA is approaching expiration.
* The active CA key is compromised or must be rotated.

<Note>Rotating the CA invalidates previously issued UserVPN files.</Note>

## Rotation Options

* **Simple Rotation**: one-pass rotation with a brief interruption
  (recommended).
* **Staged Rotation**: staged rollout with minimal downtime.

## Perform a Simple Rotation

Use this method when a short downtime window is acceptable. During the simple
rotation, the admin distributes (re-issues) client VPN files (.ovpn) once to all
VPN users.

### Prerequisites

* Access to **Settings > Configuration > Certificate Store** on the CoPilot UI.
* VPN users must be attached to their UserVPN gateway or Load Balancer.
* Ensure all VPN gateways are up and running before each step.

### Step 1: Prepare a New CA in Certificate Store

<Steps>
  <Step title="Open the Certificate Store">
    Go to **Settings > Configuration > Certificate Store**.
  </Step>

  <Step title="Add a certificate">
    Click **+ Certificate**.
  </Step>

  <Step title="Generate or upload the CA">
    Choose **Generate Certificate** or **Upload Certificate**. Generating a
    new certificate is recommended.

    * For **Generate Certificate** (recommended):
      1. Enter a name for the new CA.
      2. Select a validity period.
    * For **Upload Certificate**:
      1. Enter a name for the new CA.
      2. Upload the CA certificate file in PEM format.
      3. Upload the CA private key file in PEM format.
  </Step>

  <Step title="Save">
    Click **Add**.
  </Step>
</Steps>

### Step 2: Add the New CA to UserVPN

<Steps>
  <Step title="Open UserVPN Settings">
    Go to **Cloud Fabric > UserVPN > Settings**.
  </Step>

  <Step title="Start rotation">Click **Rotate Certificate**.</Step>

  <Step title="Prepare the new CA">
    Select the new CA and click **Prepare**.
  </Step>
</Steps>

### Step 3: Verify User Attachments

Ensure all users are attached to their gateways or Load Balancers.

<Steps>
  <Step title="Open the Users list">
    Go to **Cloud Fabric > UserVPN > Users**.
  </Step>

  <Step title="Confirm each user is attached">
    For each user, ensure the **VPN Gateway** column is not set to *Detached*.
  </Step>
</Steps>

<Note>
  If any users are detached, they must be attached to a gateway or Load Balancer
  before proceeding with the rotation.
</Note>

### Step 4: Activate the New CA

<Note>
  This step takes some time. Do not close the browser window, navigate to other
  pages, or refresh the page while this process is running.
</Note>

<Steps>
  <Step title="Locate the prepared CA">
    From **Cloud Fabric > UserVPN > Settings**, locate the newly **Prepared** CA
    entry in the Certificate table.
  </Step>

  <Step title="Activate">Click **Activate**.</Step>
</Steps>

<Info>After the new CA is activated, take the actions described below.</Info>

After activation:

* All previously issued UserVPN files become invalid. Client certificates signed
  by the old CA are revoked.
* All attached VPN users with an email configured automatically receive newly
  issued VPN files via email.
* For attached VPN users without an email configured, distribute the new VPN
  files manually:
  1. Go to **Cloud Fabric > UserVPN > Users**.
  2. Download the client VPN file for each user without an email address:
     1. Select the user.
     2. Click the three-dot menu on the right side.
     3. Click **Download Client Certificate**.
     4. Distribute the downloaded client VPN files to the respective users
        through your own admin channel.

### Step 5: Notify Users to Install New VPN Files

Inform all VPN users to download and install the newly issued VPN files from the
UserVPN portal.

<Info>
  Users cannot connect to the UserVPN server until they install the newly issued
  client VPN file.
</Info>

### Step 6: Remove the Old CA

<Steps>
  <Step title="Locate the deactivated CA">
    From **Cloud Fabric > UserVPN > Settings**, locate the **Deactivated** CA.
  </Step>

  <Step title="Remove the old certificate">
    Click **Remove Old Certificate** to delete the old CA from the Certificate
    table and complete the rotation process.
  </Step>
</Steps>

<Warning>
  Failure to remove the old CA may allow authentication using old VPN files.
</Warning>

## Perform a Staged Rotation

Use this method for a controlled, low-downtime rotation. This workflow requires
additional steps from both administrators and users because the client VPN files
(.ovpn) must be distributed two times.

### Step 1: Prepare a New CA in Certificate Store

<Steps>
  <Step title="Open the Certificate Store">
    Go to **Settings > Configuration > Certificate Store**.
  </Step>

  <Step title="Add a certificate">
    Click **+ Certificate**.
  </Step>

  <Step title="Generate or upload the CA">
    Choose **Generate Certificate** or **Upload Certificate**. Generating a
    new certificate is recommended.

    * For **Generate Certificate** (recommended):
      1. Enter a name for the new CA.
      2. Select a validity period.
    * For **Upload Certificate**:
      1. Enter a name for the new CA.
      2. Upload the CA certificate file in PEM format.
      3. Upload the CA private key file in PEM format.
  </Step>

  <Step title="Save">
    Click **Add**.
  </Step>
</Steps>

### Step 2: Add the New CA to UserVPN

<Steps>
  <Step title="Open UserVPN Settings">
    Go to **Cloud Fabric > UserVPN > Settings**.
  </Step>

  <Step title="Start rotation">Click **Rotate Certificate**.</Step>

  <Step title="Prepare the new CA">
    Select the new CA and click **Prepare**.
  </Step>
</Steps>

### Step 3: Verify User Attachments

Ensure all users are attached to their gateways or Load Balancers.

<Steps>
  <Step title="Open the Users list">
    Go to **Cloud Fabric > UserVPN > Users**.
  </Step>

  <Step title="Confirm each user is attached">
    For each user, ensure the **VPN Gateway** column is not set to *Detached*.
  </Step>
</Steps>

<Note>
  If any users are detached, they must be attached to a gateway or Load Balancer
  before proceeding with the rotation.
</Note>

### Step 4: Distribute New Client VPN Files to All Users

Before distributing new VPN files, ensure all users are attached to the correct
VPN gateway or Load Balancer. Users who are detached will not receive the
updated client VPN file.

**For users without email addresses:**

<Steps>
  <Step title="Open the Users list">
    From **Cloud Fabric > UserVPN > Users**, select the user.
  </Step>

  <Step title="Open the actions menu">Click the three-dot menu.</Step>

  <Step title="Download the client VPN file">
    Click **Download Client Certificate** to save the file locally.
  </Step>

  <Step title="Distribute the file">
    Distribute the VPN file to the user through your preferred admin
    communication channel.
  </Step>
</Steps>

**For users with email addresses:**

<Steps>
  <Step title="Re-issue client certificates">
    From **Cloud Fabric > UserVPN > Users**, click **Re-issue Client
    Certificate**.
  </Step>
</Steps>

The system sends the re-issued VPN file to each user's email inbox. This action
does not revoke any certificates. It adds both the new and current CA
certificates to the VPN file's trust bundle.

<Note>
  The re-issued files include both the old and new CA in the trust bundle,
  allowing a seamless transition for existing users. However, the embedded
  client certificate is still signed by the **old** CA. Users must install the
  second set of files (issued after the new CA is activated in Step 6) before
  the old CA can be safely removed in Step 7.
</Note>

### Step 5: Notify Users to Install New VPN Files

Inform all VPN users to download and install the newly issued VPN files from the
UserVPN portal.

<Info>
  During this phase of the staged rotation, users can continue using their
  existing VPN connections. The new VPN files become necessary after the CA is
  activated in the next step.
</Info>

### Step 6: Activate the New CA

<Steps>
  <Step title="Open UserVPN Settings">
    Go to **Cloud Fabric > UserVPN > Settings**.
  </Step>

  <Step title="Activate the prepared CA">
    Locate the **Prepared** CA entry in the Certificate table and click
    **Activate**.
  </Step>
</Steps>

<Info>
  After the activation, re-issue the client VPN files so that each user receives
  a client certificate signed by the new CA.
</Info>

To distribute the post-activation client VPN files:

* For attached VPN users with email addresses, go to \*\*Cloud Fabric > UserVPN
  > Users\*\* and click \*\*Re-issue Client Certificate\*\*. Each user receives a
  > second email containing the newly issued client VPN file, whose embedded
  > certificate is signed by the new CA.
* For attached VPN users without email addresses, repeat the manual distribution
  process from Step 4 to provide the second (post-activation) client VPN file
  through your admin channel.
* Both client VPN files (issued in Step 4 and after activation) remain valid
  until the old CA is removed. Any older client VPN files (issued before Step 4)
  are now invalid.

### Step 7: Remove the Old CA

<Warning>
  Before removing the old CA, confirm that all VPN users have installed the VPN
  files distributed after Step 6 (the second distribution). The VPN files
  issued in Step 4 (first distribution) contain a client certificate signed by
  the old CA — these profiles stop working immediately when the old CA is
  removed. Users who only installed the Step 4 files will lose VPN
  connectivity.

  If any users have not installed the post-Step 6 files, re-send those files
  before proceeding.
</Warning>

After confirming all users have installed the latest client VPN files, remove
the old CA entry.

<Steps>
  <Step title="Open UserVPN Settings">
    Go to **Cloud Fabric > UserVPN > Settings**.
  </Step>

  <Step title="Remove the deactivated CA">
    Locate the **Deactivated** CA entry and click **Remove Old Certificate**.
  </Step>
</Steps>

<Warning>
  This step is critical for maintaining security. If you do not remove the old
  CA, users with previously issued client VPN files (signed by the old CA) may
  still be able to authenticate and connect.
</Warning>

<Note>
  If any users report loss of connectivity after this step, they are still using
  the Step 4 profile. Re-issue their VPN file (it will be signed by the new CA)
  and have them reinstall it.
</Note>

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/controlplane/internal-service-ca-rotation"}>CA Certificate Rotation of Internal Service</a>