Without trust point connections, Cisco IWAN DMVPN deployments will no longer work.ĭevices with expiring certificates will generate a syslog warning once the certificate is within one week of expiration. Once the root certificate expires, Cisco APIC-EM will no longer establish trust point connections or generate any intermediate PKI certificates.

It is critically important to identify an expiring root certificate before it expires. Recovery requires manual intervention on Cisco APIC-EM, its applications, and all devices that contain certificates signed by the expired root certificate. If the root certificate expires in a Cisco APIC-EM affected release it cannot be renewed. Cisco IWAN deployments that use the Cisco APIC-EM IWAN application lose connections to the 'spokes'. Once the root certificate expires, all other intermediate certificates signed by the root are invalidated and secure trust point connections fail. It remains fixed to the original installation date and does not auto-renew. Subsequent software upgrades do not affect the root certificate expiration date. That root certificate is established when the product is initially installed and has a fixed five year expiration date. Cisco APIC-EM establishes a root certificate used to sign all intermediate certificates generated by the private CA. BackgroundĬisco APIC-EM establishes a PKI private certificate authority (CA) to manage keys and issue intermediate digital certificates to participating entities such as hosts, network devices, and users within its domain.

Once the root certificate expires it cannot be renewed and all secure connections initiated by Cisco APIC-EM fail, which includes Intelligent WAN (IWAN) Dynamic Multipoint VPN (DMVPN) connections.

The Public Key Infrastructure (PKI) root certificate used in Cisco Application Policy Infrastructure Controller-Enterprise Module (APIC-EM) expires five years after the product is initially installed. Versions 1.6.3 and 1.6.4 are also affectedĪPIC-EM Root CA Certificate expires after 5 years from installation date

Em client free demo has expired