GFI Support Home Start a conversation Sign in
Start a conversation
  1. KerioControl
  2. KerioControl - Certificates
  3. Articles

Changing SSL Certificates

Overview

If your certificate is expiring and you need to import a new one, you must also select the certificate in all Kerio Control services where the expiring certificate is used.

An expired certificate may cause PCI scan to fail with an SSL certificate cannot be trusted issue.

ssl_cannot_be_trusted.png

 

Back to top

 

Process

  1. In the Administration interface, navigate to Definitions > SSL Certificates.
  2. Create a new certificate. Refer to the Configuring SSL Certificates In Kerio Control article.
  3. Verify that the certificate is included in the SSL Certificates section.
  4. Select the certificate in all places where the expiring certificate is used (see the table below).
Services Which Need a Valid SSL Certificate The Section in Kerio Control Administration
Kerio VPN Server Interfaces
Kerio IPsec Server Interfaces
Kerio VPN Tunnel Interfaces
IPsec VPN Tunnel Interfaces
Wi-Fi Authentication (RADIUS server) Domains and User Login > Authentication Options
Reverse Proxy server Proxy Server > Reverse Proxy
SSL certificate for a reverse proxy rule. The certificate hostname must be the full DNS server name. Proxy Server > Reverse Proxy > Reverse Proxy Rule
Kerio Control Administration and Kerio Control Statistics Advanced Options > Web Interface

NOTE: we've had some isolated occurrences where the SSL certificate would not apply resulting in the admin UI getting unresponsive. If you are facing this trouble, please check the renewed SSL certificate that you received from the certification authority for any chained intermediate certificates and remove the intermediate certificate, then attempt to replace it once more, and it should work this time around.

Back to top

 

Confirmation

The new certificate gets reflected in all the updated locations.

 

Back to top

 

Choose files or drag and drop files
Was this article helpful?
Yes
No

  1. Priyanka Bhotika

  2. Posted
  3. Updated

Comments

  1. Alex S.

    We had some trouble OpenVPN connection could not be
    established because of the OpenVPN Certs (CA/Cert)
    expired.

    The solution was to disable the OpenVPN Server in Interfaces.
    (Check CA/Cert is set to "Use Default"
    and rename the Certs (CA/Cert) in something_old.

    Afterwards we enabled the OpenVPN Server in Interfaces.
    Now the 2 Certs (CA/Cert) for OpenVPN were created.

    Then we did download the new Config (.ovpn) from
    https://<Kerio Control>:4081/#
    and it worked again.